EXHIBIT C 

PLR 4-3(b) - Identification of Supporting Evidence 

The following represents InterTrust's list of evidence relevant to construction of the disputed terms and 
phrases. 

Notes: 

1 . InterTrust reserves the right to supplement this list as needed to respond to changed 
constructions proffered by Microsoft. InterTrust also reserves the right to rely on evidence cited in the 
original version of this Exhibit, filed February 3, 2003. 

2. In the following list, certain terms and phrases include other, separately defined terms. In such 
cases, the evidence supporting the separately defined term is also relevant to construction of the larger 
term. 

3. The InterTrust patents include overlapping specifications, in which the same text may be 
found in two or more specifications. Where only one of the specifications is cited, InterTrust reserves 
the right to substitute citations for the same text in the other specifications. 

4. Highlighting has been used to indicate added emphasis. 

5. Each claim term is followed by a list of all patent claims in which the term appears (e.g., 
"1 93 . 1 5" means claim 1 5 from the 4 1 93 patent). 



Key to abbreviations: 

USP = United States Patent 
' 1 93 patent = USP 6,253, 1 93 
'683 patent = USP 6,1 85,683 
'721 patent = USP 6,157,721 
'891 patent - USP 5,982,891 
'861 patent = USP 5,920,861 
'912 patent = USP 5,917,912 
'900 patent = USP 5,892,900 
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Claim Term / 
Phrase 


InterTrust Evidence 


1. 


aspect 

683.2, 861.58, 
900.155,912.8 


Patent Soecifications 
1(A) 

inis reinitialization mecnanism wouiq peuim i/ru/oru ^d*ju 10 uc 
initialized several times, facilitating testing and/or re-use for 
different applications, while protecting all security-relevant 1111111 
of its operation. 

'900 patent at 77:15-19. 


KB) 

In addition, tne overall sonware-Daseu lamper resistant oarncr o /** 
and associated PPE system is sufficiently complex so that it is 
difficult to tamper with a part of it without destroying other 111111 
of its functionality (i.e., a "defense in depth"). 

'900 patent at 236:3-7. 


1(C) 

As with any system incorporating "applications" and "operating 
systems," the boundary between these fH^i of an overall system 
can be ambiguous. 

4 193 patent at 83:30-32. 


1(D) 

Since SPE 503 in thepreferred embodiment runs within the confines 
of an SPU 500, one Sp^fl of this device driver 736 is to provide 
low level communications services with the SPU 500 hardware. 

'193 patent at 95:27-30. 


1(E) 

Templates may present one or more models that describe various 
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JL 111 A0V 
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lllll§ of a content object and how the object should be created 
including employing secure atomic methods that are used to create, 
alter, and/or destroy permissions records 808 and/or associated 
budgets, etc. 






'193 patent at 260:42-47. 






1(F) 






In accordance with one 11111 of how to advantageously use 
descriptive data structures in accordance with a preferred 
embodiment of this invention, a machine readable descriptive data 
structure may be created by a provider to describe the layout of the 






provider's particular rights management data structure(s) such as 
secure containers. 






'861 patent at 6:24-29. 






1(G) 






Controls 316 may provide rules and associated coM^uraces for 
controlling or otherwise affecting the use or other gS|gg|s of what 
value chain participant 602 can do with DDS 200. 






'861 patent at 17:3-6. 
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InterTrust Evidence 


2. 


authentication 

193.15 


Patent Snecifications 


2(A) 

To increase the security of security barrier 502 even further, it is 
possible to encase or include SPU 500 in one or more further 
physical enclosures such as, for example: epoxy or other "potting 
compound"; further module enclosures including additional self- 
destruct, self-disabling or other features activated when tampering is 
detected; further m °dules^roviding^di^£d^iirity protections 
such as requiring ^^^^l^^^^^^^S^ to operate; and 
the like. 

4 193 patent at 64:29-37. 


2(B) 

It may also or alternatively provide or include one or more 
' 193 patent at 236:21-25. 


2(C) 

This certification process in the preferred embodiment may be used 

t<ypern^a^V]^ ^ ec^^mii^^^^Ua^^e^ t<g ?^^^^^LS^^^^^^^^ 

described above, this "certification" process may be used by one 
PPE 650 to "certify" that it is an authentic VDE PPE, it has a certain 
level of security and capability set (e.g., it is hardware based rather 
than merely software based), etc. Briefly, the "certification" process 
may involve using a certificate private key of a certification key pair 
to encrypt a message including another VDE node's public-key. The 
private key of a certification key pair is preferably used to generate 
a PPE certificate. It is used to encrypt a public-key of the PPE. A 
PPE certificate can either be stored in the PPE, or it may be stored in 
a certification repository. 

'193 patent at 213:1-15. 
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2(D) 






SPE Authentication Manager/Service Communications 
Manager 564 






The ^^^^^i^^^^S^Service Communications Manager 564 
^nnnnrte ralk for user nassword validation and '^ticket" generation 
and validation. It may also support secure communications between 
SPF 503 and an external node or device (e.g., a VDE administrator 
or distributor). It may support the following examples of 
authentication-related service requests in the preferred embodiment: 






Call Name Description 






User Services 






Create User Creates a new user and stores Name 

Services Records (NSRs) for use by the 
Name Services Manager 752. 






^^^^||^^ Authenticates a user for use of the 
system. This request lets the caller 

by this request. The authentication 
returns a "ticket" for the user. 






4 193 patent at 123:21-42. 
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Claim Term / 
Phrase 


InterTrust Evidence 


3. 


budget 

193.1 


Patent Specifications 


3(A) 

PERC 808 may also contain or refer to ^§^^^^^^ 
PiMa«Mi. Such budgets may be stored 
within a traveling obiect itself, or they may be delivered separately 
and protected by highly secure communications keys and 
administrative object keys and management database techniques. 

'193 patent at 132:60-65. 


3(B) 

There are 

many types of UDEs 1200 and MDEs 1202 provided by the 
preferred embodiment. In the preferred embodiment, each of these 
different types of data structures shares a common overall format 
including a common header definition and naming scheme. Other 
UDEs 1200 that share this common structure include "local name 
services records" (to be explained shortly) and account information 
for connecting to other VDE participants. These elements are not 
necessarily associated with an individual user, and may therefore be 
considered MDEs 1202. All UDEs 1200 and all MDEs 1202 
provided by the preferred embodiment may, if desired, (as shown in 
Figure 16) be stored in a common physical table within secure 
database 610, and database access processes may commonly be used 
to access all of these different types of data structures. 

In the preferred embodiment, PERCs808 and userri^stob^ 

^^^^mW^m^^^m, including for example, meters, meter 
trai^^^S, budget trails, and audit trails. 

'193 patent at 142:41-61. 


3(C) 

In the example shown in Figure 4 Id, a distributor at a VDE 
distributor node (106) might ^pe^^pjji from a content creator 
at another node (102). This request may be made in the context of a 
secure VDE communication or it may be passed in an "out-of- 
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channel" communication (e.g. a telephone call or letter). ||| 
^M^H^^P to the distributor 106 and 

VDE no^ J 02)^ result of processing the distribute event within 
the IjP^^f^^^l might be a secure communication (1454) 
between VDE nodes 102 and 106 by which a granting use 
and redistribute rights to the distributor 1 06 may be transferred from 
the creator 102 to the distributor. The distributor's VDE node 106 
may respond to the receipt of the ^^^^^^^ by OToc^sing 
the communication using the reply process 1475B of the ^^^tf 
111111 15 1°- Th e re Ply event processing 1475B might, for 
example, install a WSM md PERC 808 within the distributor's 
VDE 1 06 node to permit the distributor to access content or 
processes for which access is control at least in part by the I11E1 
and/or PERC. At some point, the distributor 106 may also desire to 
use the content to which she has been granted rights to access. 

After registering to use the content object, the user 1 12 would be 
required to utilize an array of "use" processes 1476C to, for 
example, open, read, write, and/or close the content object as part of 
the use process. 

(1482AB) with the content creator VDE node 102 requesting more 
llllp and perhaps providing details of the use activity to dat |i|J^ 
auditfrails). The content creator 102 processes the 'get more j^P^i 
request event 1 482 AB using the response process (1484 A) within 
the creator's ^^^^P^^S 1510A. Response process 1484 A 
might, for example, make a determination if the use information 
indicates proper use of the content, and/or if the distributor is credit 
worthy for more mmM, The W&mmmmM response process 
1484A might also initiate a financial transaction to transfer funds 
from the distributor to pay for said use, or use the distribute process 
1472A to distribute budget to the distributor 106. A resjrarge to the 
distributor 106 granting more Bill (or denying more BR) 
might be sent immediately as a response to the request 
communication 1482AB, or it might be sent at a later time as part of 
a separate communication. The response communication, upon 
being received at the distributor's VDE node 106, might be 
processed using the reply process 1475B within the distributor's 
copy of the 1S10B. The reply process 1475B 
might then process the additional lllll in the same manner as 
described above. 
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The chain of handling and control may, in addition to posting 
||||g|| information, also pass control information that governs the 
manner in which said IlliS may be utilized. For example, the 
control information specified in the above example may also contain 
control information describing the process and limits that apply to 
the distributor's redistribution of the right to use the creator's content 
object. Thus, when the distributor responds to a IlliS request 
from a user (a communication between a user at VDE node 1 12 to 
the distributor at VDE node 106 similar in nature to the one 
described above between VDE nodes 106 and 102) using the 
distribute process 1472B within the distributor's copy of the 
l^P^^^^ 1510B, a distribution and request/response/reply 
process similar to the one described above might be initiated. 

*193 patent at 172:61-174:29. 


= — -— ====================== 

3(D) 

BILLING method 406 may then pass the event on to a BUDGET 
method 408. BUDGET method 408 sets limits and records 
transactional information associated with those limits. For example, 




flip, and may store an audit record in a budget trail UDE. 
BUDGET method 408 may result in a "budget remaining" field in a 
budget UDE being decremented by an amount specified by 
BILLING method 406. 

'193 patent at 182:22-30. 


3(E) 

PliPPi^OS^ 1510 may read and update ^f^l^^^M^ 
within a BUDGET method UDE, 

'193 patent at 184:67-185:1. 


3(F) 

Figure 5 A shows how the virtual distribution environment 100, in a 
mffi^ffi^^L may package information elements (content) 
into a "container" 302 so the information can't be accessed except as 
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provided by its "rules and controls." Normally, the container 302 is 
electronic rather than physical. Electronic container 302 in one 
example comprises "digital" information having a well defined 
structure. Container 302 and its contents can be called an "object 
300." 

The Figure 5 A example shows items '^within" and enclosed by 
container 302. However, container 302 may "contain" items 
without those items actually being stored within the container. For 
example, the container 302 may reference items that are available 
elsewhere such as in other containers at remote sites. Container 302 
may reference items available at different times or only during 
limited times. Some items may be too large to store within 
container 302. Items may, for example, be delivered to the user in 
the form of a "live feed" of video at a certain time. Even then, the 
container 302 "contains" the live feed (by reference) in this 
example. 

Container 302 may contain information content 304 in electronic 
(such as "digital") form. Information content 304 could be the text 
of a novel, a picture, sound such as a musical performance or a 
reading, a movie or other video, computer software, or just about 
any other kind of electronic information you can think of. Other 
types of "objects" 300 (such as "administrative objects") may 
contain "administrative" or other information instead of or in 
addition to information content 304. 

(a) a "permissions record" 808; 

(b) "I^^^H; and 

(c) "other methods" 1000. 

•^^^^^^^tf ™d c^er method^ 1 000. The permissions 
record" 808 specifies the rights associated with the object 300 such 
as, for example, who can open the container 302, who can use the 
object's contents, who can distribute the object, and what other 
control mechanisms must be active. For example, permissions 
record 808 may specify a user's rights to use, distribute and/or 
administer the container 302 and its content. Permissions record 
808 may also specify requirements to be applied by the budgets 308 
and "other methods" 1000. Permissions record 808 may also 
contain security related information such as scrambling and 
descrambling "keys." 
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"Other methods" 1000 define basic operations used by "rules and 
controls." Such "methods" 1000 may include, for example, how 
usage is to be "metered," if and how content 304 and other 
information is to be scrambled and descrambled, and other 
processes associated with handling and controlling information 
content 304. For example, methods 1000 may record the identity of 
anyone who opens the electronic container 302, and can also control 
how information content is to be charged based on "metering." 
Methods 1000 may apply to one or several different information 
contents 304 and associated containers 302, as well as to all or 
specific portions of information content 304. 

'193 patent at 58:38-59:37. 


3(G) 

FIGURES 5 A and 5B show an BBi of an "object"; 
'193 patent at 50:18. 


3(H) 

Typical Description or 
Field type Format Use Use 

Ascending byte, short, Meter/ Ascending count 
Use Counter long, or Budget of uses. 

unsigned 

versions of 

the same 

widths 

|PQjp byte, short, Budget m^MmM 
"^^^^M long, or fi^^^^^i 

unsigned ^^mmmms 
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versions of gudggg 

the same 

widths 






4 193 patent at 143:57-65: 






As with standard VDE objects 300, a user may be required to 
contact a clearinghouse service to acqmre^plaoi|^OT3©|^^^ 












'193 patent at 131:10-13 . 






3(J) 






initiate a process using the BUDGET method request process 
(1480B). Request process 1480B might initiate a communication 
(1482AB) with the content creator VDE node 102 requesting more 
budget and perhaps providing details of the use activity to date (e.g., 
audit trails). The content creator 102 processes the 'get more budget' 
request event 1482AB using the response process (1484 A) within 
the creator's BUDGET method 1510A. Response process 1484A 
might, for example, make a determination if the use information 
indicates proper use of the content, and/or if the distributor is credit 
worthy for more budget. The BUDGET method response process 
1484 A might also initiate a financial transaction to transfer funds 
from the distributor to pay for said use, or use the distributejprocess 






1 f^A^ 

communication 1482AB, or it might be sent at a later time as part of 
a separate communication. The response communication, upon 
being received at the distributors VDb node 106, might be 
processed using the reply process 1475B within the distributor's 
copy of the BUDGET method 151 OB. The reply process 1475B 
might then process the additional budget in the same manner as 
described above. 






'193 patent at 173:21-174:14. 
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3(K) 

During the same or different communications exchange, the same or 

different ^Ieja^^^^m^^OT^^^^^I^fMag§^^ 
B^WSM and/or permission pertaining to VDE object 300. 
For example, the end user f s electronic appliance 600 may (e.g., in 
response to a user input request to access a particular VDE object 
300) send an administrative object to the clearinghouse requesting 
budgets and/or other permissions allowing access (Block 1 164). As 
mentioned above, such requests may be transmitted in the form of 
one or more administrative objects, such as, for example, a single 
administrative object having multiple "events" associated with 
multiple requested budgets and/or other permissions for the same or 
different VDE objects 300. The clearinghouse may upon receipt of 
such a request, check the end user ! s credit, financial records, 
business agreements and/or audit histories to determine whether the 
requested budgets ^d^ 

r^^ 

session to provide further updates to the end user's secure database 
610. 

4 193 patent at 162:39-65. 


Extrinsic Sources 
3(L) 

budget n. l.a. An itemized summary of estimated or intended 
expenditures for a given period along with proposals for financing 
them: submitted the annual budget to Congress, b. A systematic 
plan for the expenditure of a usually fixed resource, such as money 
or time, during a given period: A new car will not be part of our 
budget this year. c. The total sum of money allocated for a 
particular purpose or period of time: a project with an annual 
budget of five million dollars. 2. WU^B^^BBBBM 
||§|]| : his budget of general knowledge'' (William Hazlitt). - 
budget v. — et-ed, et-ing, -ets. -tr. 1. To plan in advance the 
expenditure of: needed help budgeting our income; budgeted my 
time wisely. 2. To enter or account for in a budget: forgot to budget 
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/fce car payments, -intr. To make or use a budget, -budget aaj. l. 
Of or relating to a budget: Wge/ //ems approved by Congress. 2. 
Appropriate to a budget; inexpensive: a budget car; budget meals. 

American Heritage Dictionary, 3d ed. (HouRhton Mifflin, 1992), p. 249. 
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4. 


clearinghouse 
193.19 


Patent Specifications 


4(A) 

Clearinghouses mav provide independent nnaneia&seryiees, such as 
credit and/or billing services, and can serve as iJ^^^^^gn^S 
creators. 

6 193 patent at 267:40-42. 


4(B) 

if appropriate credit (e.g. an electronic clearinghouse account from a 
i^^^^^^^^^^^B) is available. 

4 193 patent at 25:22-24. 


4(C) 

clearinghouses that gather usage information regarding, and bill for 
the use of, electronic information. 

4 193 patent at 3:32-33. 


4(D) 

in certain models, ^^^^W^^IIS^^^^^^^^^ 
H^l^^^^^^I who provides one or more rights to certain value 
chain participants, which one or more rights may be "attached" to 
one or more rights to use the clearinghouse's credit (if said 
cleannghouse is, at least in part, a S^^gffl^^SSSMS^ (sucn a 
control information provider may alternatively, or in addition, 
restrict other users' rights. 

c 193 patent at 269:59-65. 


4(E) 

A document may have an attribute requiring that each use of the 
document be reported to a central mjms^l^^M^MMm^^^' 
This could be used by the organization to track specific documents, 
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to identify documents used by any particular user and/or group of 
users to track documents with specific attributes (e.g., sensitivity), 
etc. 

'193 patent at 280:18-24: 


4(F) 

In this Figure 2 example, information relating to content use is, as 
shown bv arrow 1 14, reported to a ^^^^^^^^^ 1 16. 
Based on this "reporting," the financial clearinghouse 1 16 may 
generate a bill and send it to the content user 1 12 over a "reports and 
payments" network 118. Arrow 120 shows the content user 1 12 
providing payments for content usage to the financial clearinghouse 
116. Based on the reports and payments it receives, the financial 
clearinghouse 116 may provide reports and/or payments to the 
distributor 106. 

'193 patent at 55:57-66. 


4(G) 

The "^fgg^H" 1 16 shown in Figure 2 may also be a 
"VDE administrator." Financial clearinghouse 1 16 in its VDE 
administrator role sends "administrative" information to the VDE 
participants. This administrative information helps to keep the 
virtual distribution environment 1 00 operating properly. The "VDE 
administrator" and financial clearinghouse roles may be performed 
by different people or companies, and there can be more than one of 
each. 

'193 patent at 56:16-24. 


4(H) 

A summary of the roles of the various participants of virtual 
distribution environment 100 is set forth in the table below: 

Role Description 


"Traditional" 
Participants 

Content creator Packager and initial distributor of digital 
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information 

Content Owner Owner of the digital information. 

Distributors Provide rights distribution services for 
budgets and/or content. 

Auditor Provides services for processing and reducing 
usage based audit trails. 

Also, typically provides a platform for other 
services, including third party financial 
providers and auditors. 

'193 patent at 255:33-51. 


4(D 

Further Chain of Handling Model 

As described in connection with Figure 2, there are four (4) 
"participant" instances of VDE 100 in^H^B of a VDE chain 
of handling and control used, for example, for content distribution. 

' 1 93 patent at 253 :64-254: 1 . 


4(J) 

FIGURE 2 illustrates 'M^^M °f a chain of handling and control; 
'193 patent at 50:8-9. 


4(K) 

a "trusted" financial clearinghouse (e.g., VISA, Mastercard). 
'193 patent at 41:8-9. 
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5. 


compares 
900.155 


Patent Specifications 


5(A) 

^^^^^^^^^^^^^^^^ reveals that the same overall 
high level processing may typically be performed for READ method 
1650 as was described in connection with OPEN method 1500. 

'900 patent at 195:9-12. 


5(B) 

administrator" participant 700. 
'900 patent at 280:63-65. 


5(C) 

VDE content, and the electronic agreements associated with said 
content, can be employed and progressively manipulated in 
commercial ways which reflect traditional business practices for 
non-electronic products (though ^m^BW§mSS§^^^Sm 

'900 patent at 322:15-20. 


Extrinsic Sources 


5(D) 

compare v. /r. 1. To consider 

^^S^S3.&« To fom the positive, 
comparative, or superlative degree of (an adjective or adverb). - 
intr. 1. To be worthy of comparison; bear comparison: two concert 
halls that just do not compare. 2. To draw comparisons. 

comparison w. La* The act of comparing or the process of being 
compared. 

American Heritage Dictionary, 3d ed. (Houghton Mifflin, 1992), p. 384. 
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6. 


component 
assembly 

912.8,912.35 


Patent Specifications 
6(A) 

ROS VDE functions 604 may be based on segmented, 
independently loadable executable "component assemblies" 690. 
These component assemblies 690 are independently securely 
deliverable. 

jM^M^^^tofeS. Thus, each component 

assembly 690 provided by the preferred embodiment is comprised 
of independently securely deliverable elements which may be 
communicated using VDE secure communication techniques, 
between VDE secure subsystems. 

These component assemblies 690 are the basic functional unit 
provMedbyROS 602. g^^^jjlimi 

'193 patent at 83:12-26. 


6(B) 

SW^^^ol^^t^S^fSafsSjilf^^Pe^Sf^S^^P 
executing the^T^n^^psemblv^^^^^^ecure operating 

'193 patent at 83:43-48. 


6(C) 

690 that may be used for 

event processing. 
193 patent at 1 15:67-116:4. 
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6(D) 

Permissions Records ("PERC's) 808; 
Melhod^Cores" 1000; 

DataElements (e^User Data Elements ("UDEs") 1200 and 
Method Data Elements ("MDEs") 1202); and 
Other component assemblies 690. 

'193 patent at 85:21-29. 


6(E) 

The selected method event record 1012, in turn, W^S^M 

mom&t momMmtmimMmm 1 100, data dement 

UDE(s) and MDE(s) 1200, 1202, jQf PERC(s) 808) used to 
construct a component assembly 690 for execution in response to 
the event that has occurred. 

'193 patent at 138:31-36. 


6(F) 

The reciprocal process 1454 may be based on a ^^^^^B 
MMW! one or more — H 1 100, data, and 
optionally other methods present in the VDE node 600B). 

'193 patent at 171:39-42. 


6(G) 

One important security layer involves ensuring that 111!! 
I^iinel^^rllii 690 are formed, loaded and executed only in 

'193 patent at 87:35-38. 
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6(H) 

ROS 602 provided by the ^^^^^^^^^ ^^^^^^ 
f||p by specifying and beg^L^processes to process the event. 
These processes are, in the^^^^^^^^^i, based on methods 
1000. Since there are an unlimited number of different types of 
events, the ^^^^^^^^^p supports an unlimited number of 
different P roce ss^toprocess events. This flexibility is supported 
by the ^^^^^^^^^ of component assemblies 690 from 
independently deliverable modules such as method cores 1000', load 
modules 1 100, and data structures such as UDEs 1200. 

'193 patent at 169:62-170:4. 


6(1) 

^^^^S^^SI^^^^^^S^^^ assembles securely 
independently deliverable elements into lacom^nerrt assembly 690 
based in part on context parameters M^^^^M^^^ 

'193 patent at 84:17-20. 


6(J) 

This "channel 0" "open channel" task may then issue a series of 
requests to secure database manager 566 to obtain^^^p^^^S 

ag^^ 

to ac^ 

from load module execution manager library(ies) 568) the 
appropriate "control method" that may be used to, in effect, 
supervise execution of all of the other methods 1000 within the 
channel 594 (block 1131). 

'193 patent at 1 12:46-51, 1 12:63-1 13:2. 
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File Histories 
6(K) 

Column 1, lines 33-65 [of Fischer 5,748,960] describes ^g^pes" 
or "classes" in object-orientedprogramming that meets Wk£g&i 
fecomjaonfenf^ 

'912 Patent File History, 9/22/98 Office Action, pp. 2-3. 
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7. 


contain 

683.2,912.8, 
912.35 


Patent Specifications 
7(A) 

A VDE content container is an object that p^ii both content (for 
example, commercially distributed electronic information products 
such as computer software programs, movies, electronic 
publications or reference materials, etc.) and certain control 
information related to the use of the object's content. 

'193 patent at 19:15-21. 


7(B) 

The Figure 5A example shows items "within" and enclosed by 

<^n^ 

m^ ite^ at ^dif^re^ t^^or only during 
limited times. Some items may be too large to store within 
container 302. Items may, for example, be delivered to the user in 
the form of a "live feed" of video at a certain time. Even then, the 
container 302 "contains" the live feed (by reference) in this 
example. 

4 193 patent at 58:48-58. 


Extrinsic Sources 
7(C) 

contain try. -tained, -tain-ing, -tains. 1. a. ^pl^^^^^^l. 
b. To be capable of holding. 2. To have as component parts; include 
or comprise: The album contains many memorable songs. 3. a. To 
hold or keep within limits; restrain: / could hardly contain my 
curiosity, b. To halt the spread or development of; check: Science 
sought an effective method of containing the disease. 4. To check 
the expansion or influence of (a hostile power or ideology) by 
containment. 5. Mathematics. To be exactly divisible by. [Middle 
English conteinen, from Old French contenir, from Latin continere : 
com-, com- + tenere, to hold. See ten-.]--con-tain f a-ble adj. 
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SYNONYM: contain, hold, accommodate. These verbs mean to 
have within or have the capacity for having within. Contain means 
to have within or have as a part or constituent: This drawer contains 
all the cutlery we own. The book contains some amusing passages. 
Polluted water contains contaminants. Hold can be used in that 
sense but primarily stresses capacity for containing: The pitcher 
holds two pints but contains only one. Accommodate refers to 
capacity for holding comfortably : The restaurant accommodates 50 
customers. Four hundred inmates were crowded into a prison 
intended to accommodate 200 . 

American Heritage Dictionary, 3d ed, (Houghton Mifflin, 1992), p. 406. 
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8. 


control (n.) 

193.1,193.11, 
193.15, 193.19, 
891.1 


Patent Specifications 
8(A) 

Consumers 206, 208, 210 are each capable of receiving and using 
the programs created by video production studio 204 — assuming, 
that is, that the video production studio or information utility 200 
has nm n Z,*A f ^ r thMft mnsnmers to have appropriate "1111^111 
^^^iS^^lSip^^) that give the consumers rights to use 
the programs. 

'193 patent at 53:53-59. 


8(B) 

The virtual distribution environment 100 prevents use of protected 
information except as permitted bv the "lid^^^^^^^^^^S 
^^^^^). For example, the "rules and controls" shown in 
Figure 2 may grant specific individuals or classes of content users 
1 12 "permission" to use certain content. They may specify what 
kinds of content usage are permitted, and what kinds are not. They 
may specify how content usage is to be paid for and how much it 
costs. As another example, "rules and controls" may require content 
usage information to be reported back to the distributor 106 and/or 
content creator 102. 

4 193 patent at 56:26-36. 


8(C) 

Objects may be classified in one sense based on whether the 
protection information is bound together with the protected 
information. For exan^le^^JgaM^te^fl^n^^^ 

j|p§fP»il^i but rather carries sufficient control and 
permissions to permit its use, in whole or in part, at any of several 
sites is called a "Traveling Object". ... 

'193 patent at 129:52-60. 
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8(D) 

fP^^^Bj VDEF control information may be 
specifically associated with one or more pieces of electronic content 
and/or it may be employed as a general component of the operating 
system capabilities of a VDE installation. 

'193 patent at 18:36-42. 


8(E) 

Failure information, including the elements listed below, may be 
saved along with details of the failure: 

pbniolIipfiiMin Retained in an 
SPE on Access Failures 

This information may be analyzed to detect cracking attempts or to 
determine patterns of usage outside expected (and budgeted) norms. 
The audit trail histories in the SPU 500 may be retained until the 
audit is reported to the appropriate parties. 

'193 patent at 121:15-32. 


8(F) 

In this embodiment, the additional memory may be provided by 
additional one or more integrated circuits that can be contained 
within a secure enclosure, such as a tamper resistant metal container 
or some form of a chip pack containing multiple integrated circuit 
components, and which impedes and/or evidences tampering 
attempts, and/or disables a portion or all of SPU 500 or associated 
^S^^^^miimS^^^m^M m ™ e event of 
tampering. 

'193 patent at 169:5-13. 



25 



\ t 





Claim Term / 
Phrase 


InterTrust Evidence 






8(G) 

. . . may involv^reservmg at leas^a^^n oftihe 
'193 patent at 33:12-14. 


8(H) 

VDE control information may, in part or in full, (a) represent control 
information directly put in place by VDE content control 
information pathway participants, and/or (b) comprise control 
information put in place by such a participant on behalf of a party 
who does not directly handle electronic content (or electronic 
appliance) permissions records information (for example control 
information inserted by a participant on behalf of a financial 
clearinghouse or ^^ enUBen ^^^^^^^^^^^^^^^^^^^^ 

^^^^^^fe^^W^sobe put in place by either an 
electronic automated, or a semi-automated and human assisted, 
control information (control set) negotiating process that assesses 
whether the use of one or more pieces of submitted control 
information will be integrated into and/or replace existing control 
information (and/or chooses between alternative control information 
based upon interaction with in-place control information) and how 
such control information may be used. 

* 193 patent at 44:34-52. 


8(1) 

In either embodiment, certain ^^^^^^^Bl^^^^^^^ 
^^^^^^^) must be securely maintained within the SPU, and 
further control information can be stored externally and securely 
(e.g. in encrypted and tagged form) and loaded into said hardware 
SPU when needed. 

4 193 patent at 49:50-55. 


8(J) 
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j^^^^^^^^j (such as governments, financial credit 
providers, and users). 

'193 patent at 15:46-50. 


8(K) 

VDE's usage control information, for example, provide for property 
content and/or appliance related: usage authorization, usage 
auditing (which may include audit reduction), usage billing, usage 
payment, privacy filtering, reporting, and security related 
communication and encryption techniques. 

'193 patent at 15:33-38. 


8(L) 

may constitute one or more "proposed" electronic agreements 
(and/or agreement fl^^^^|^^^o^l^^^^^^^^Vj^^ 

^^^^^^^^and which can enact the terms and conditions of 
agreements involving multiple parties and their various rights and 
obligations. 

'193 patent at 19:22-32. 


8(M) 

... an end-user of such content might be to^^J^P^ffig^^ 
content!^ 

deSlroiieotn^^ 
'193 patent at 48:29-34. 
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8(N) 

In ^Ji^£^F^^^^ 0ntainer 302 may also contain 

Figure 5B gives some additional detail about permissions record 
808, budgets 308 and other methods 1000. The "permissions 
record" 808 specifies the righte^^^ed ^^^fej^^^^^^^ 

^^^^^^^^^^^^^^^fe^ii'and what oth ct 
control mechanisms must be active. For ex^^^y^^^^^s 

^^^^^^^^^^^^^B^Pei^ssions record 
808 may also specify requirements to be applied by the budgets 308 
and "other methods" 1000. Permissions record 808 may also 
contain security related information such as scrambling and 
descrambling "keys." 

"Budgets" 308 shown in Figure 5B are a special type of "method" 
1000 that may specify, among other things, limitations on usage of 
information content 304, and how usage will be paid for. Budgets 
308 can specify, for example, how much of the total information 
content 304 can be used and/or copied. The methods 310 may 
prevent use of more than the amount specified by a specific budget. 

'193 patent at 59:1-25. 


8(0) 

A distributed database may manage such a distributed repository 
resource environment and use VDE tomw^^^m^^^^^ > ^^ 
commipicatmi^^ 

'193 patent at 284:22-26. 


8(P) 

ROS 602 provided by the ^leiSi^^^^^ extends 
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conventional capabilities such as, for example, Access Control List 
(ACL) structures, to user and process defined events, including state 
transitions. ROS 602 may provide full control information over 
pre-defined and user-defined application events. These control 
mechanisms include "go/no-go" permissions, and also include 
optional event-specific executables that permit complete flexibility 
in the processing and/or controlling of events. This structure 
permits events to be individually controlled so that, for example, 
metering and budgeting may be provided using independent 
executables. Fcfr^exlimme^ 

^3S^ffiffiS^^ffiffi^^fetf§®^^- Traditional operating 
systems provide static "go-no go" control mechanisms at a file or 
resource level; ROS 602 extends the control concept in a general 
wav from the largest to the smallest sub-element using a flexible 
control structure. ROS 602 can, for example, control the printing of 
a single paragraph out of a document file. 

'193 patent at 77:45-63. 


8(Q) 

governing each 

component. The control information may be provided in a template 
format such as method oDtions to an end-user. An end-user mav 
then customize the actual control information used within guidelines 
provided by a distributor or content creator. 

4 193 patent at 77:64-78:3. 


8(R) 

VDE ^^^^i^gi that collectively control 
use of VDE managed properties (database, document, individual 
commercial productffeareteiite^ (for 
example, m a content containeroianpo^^ 

separkSlyM^ 
methodl|fo$a^0^ 
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^^^pil to a user or otherwise made available for use (such as 
being available remotely by telecommunication means). 

'193 patent at 43:26-37. 


8(S) 

^^^^^^^^^Jffand singiri^ incomb^ 

with associated data), run as control methods under the VDE 

transaction operating environment. 

'193 patent at 25:48-52. 


8(T) 

Traveling objects can be used at a receiving VDE node electronic 
appliance 600 so long as either the appliance carries the correct 
budget or budget type (e.g. sufficient credit available from a 
clearinghous^^^as^. ^^Ab^^t) 

object itself carries with it sufficient budget allowance or an 
appropriate authorization (e.g., a stipulation that the traveling object 
may be used on certain one or more installations or installation 
classes or users or user classes where classes correspond to a 
specific subset of installations or users who are represented by a 
predefined class identifiers stored in a secure database 610). After 
receiving a traveling object, if the user (and/or installation) doesn't 
have the appropriate budget(s) and/or authorizations, then the user 
could be informed by the electronic appliance 600 (using 
information stored in the traveling object) as to which one or more 
parties the user could contact. 

'193 patent at 131:33-50. 


8(U) 

[A]n object provider might allow users to redistribute copies of an 
object to their friends and associates (for example by physical 
delivery of storage media or by delivery over a computer network) 
such that if a friend or associate satisfies any certain criteria required 
for use of said object, he may do so. 
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For example, if a software program was distributed as a traveling 
object, a user of the program who wished to supply it or a usable 
copy of it to a friend would normally be free to do so. Traveling 
Objects have great potential commercial significance, since useful 
content could be primarily distributed by users and through bulletin 
boards, which would require little or no distribution overhead apart 
from registration with the "original" content provider and/or 
clearinghouse. 

The "out of channel" distribution may also allow the provider to 
receive payment for usage and/or elsewise maintain at least a degree 
of control over the redistributed object. Such certain criteria might 
involve, for example, the registered presence at a user's VDE node 
of an authorized third party financial relationship, such as a credit 
card, along with sufficient available credit for said usage. 

Thus, if the user had a VDE node, the user might be able to use the 
. traveling object if he had an appropriate, available budget available 
on his VDE node (and if necessary, allocated to him), and/or if he or 
his VDE node belonged to a specially authorized group of users or 
installations and/or if the traveling object carried its own budget(s). 

4 193 patent at 131:59-132:18. 


8(V) 

VDE supports multiple differing hierarchies of client organization 
control information wherein ^ 

departments^ users^ a depLtment 
(division) network manager can function as a distributor (budgets, 
access rights, etc.) for department networks, j^^l§, and/or users, 
etc. 

'193 patent at 33:63-34:3. 


File Histories 
8(W) 

Claims ... are rejected under 35 U.S.C. 102(b) as being anticipated 
bv Lofberg (4,595,950). 
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The recited first device and its operation matches that of Ae rent 
terminal. . . . ^S^^^^^^K^ffiP^^^M 
^^^^^l^te«fSBaM> see col. 3, lines 60-68 and col 

4, lines 64-68 and col. 13, lines 1-11 The second device is the 

user station. The rent terminal determines whether the digital file 
may be copied and stored on the second device, see col. 9, lines 1-8 
and col. 12, lines 43-49. The second device renders the digital file 
through 

its output only upon the data carrier having the information 
recorded therein and governing the use of the digital file is 
transferred to the second device. 

4 1 93 Patent File History, 6/7/00 Office Action, p. 2. 


8(X) 

Claims ... are rejected ... as being anticipated by Karp 
(4,866,769). 

. . . The first device is a personal computer that is allowed access to 
the software by virtue of an encoded checkword derived from a 
source ID on the diskette and the personal computer ID, see 
Abstract. pitedBfen^ 

^m^m^^imm^m^mm^^Si^ see coi. 5, ime 

60 through col. 6, line 1 1 . A second device is represented by a 
second checkword stored in the list, see col. 8, lines 1-18. The 
determination of whether the digital file may be copied and stored 
by a second device is dependent on whether a checkword for the 
second device is allowed. 

4 193 Patent File History, 6/7/00 Office Action, pp. 3-4. 


800 

Claims 58-59 are rejected ... as being anticipated by Schull 
[5,509,070]. 

The Schull reference describes a system for distribution, registration 

andpurchase of software ^^^^^^f^^^^^^mWW^^ 

f fe^^^^^ to unlock the advanced features of the copied 
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software. Column 7, line 10 through column 8, line 9 describe the 
generation and assignment of the target IDs and passwords. 

USP 5,915,019 File History, 7/28/97 Office Action, p. 3. 


8(Z) 

[Okano, 5,504,818] describes a system using cryptography for 
processing various digital objects. Figure 3 and column 6, line 33 
disclose wh^ 


USP 5,915,019 File History, 7/28/97 Office Action, p. 3. 


8(AA) 

A comparison of independent claim 7 to Fischer to derive the 
similarities and differences between the claimed invention and the 

channel 12; a processor as processor with main memory, 2.... 
'683 File History, 1 1/12/99 Office Action, p. 4. 
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9. 


controlling, 
control (v.) 

193.1,861.58 


Patent Specifications 
9(A) 

Secondary storage 652 in tWsjsxample stores code and data used by 
CPU 654 and/or SPU 500 to clnlll the overall operation of 
electronic appliance 600. 

'193 patent at 62:58-60. 


9(B) 

The other CPU(s) 654 may be any centrally ^^^^ logic 
arrangement, such as for example, a microprocessor, other 
microcontroller, and/or array or other parallel processor. 

'193 patent at 64:55-58. 


9(C) 

A shared address/data bus arrangement 536 may trarefer 
information between these various components under of 
microprocessor 520 and/or DMA controller 526. 

4 193 patent at 65:35-38. 


9(D) 

In some implementations, a separate arithmetic accelerator 544 may 
be omitted and any necessary calculations jmay be performed by 
microprocessor 520 under software ^||^. 

4 193 patent at 68:46-49. 


9(E) 

DMA control ler 526 '^^M information transfers over 
address/data bus 536 without requiring microprocessor 520 to 
process each individual data transfer. 

4 193 patent at 68:51-53. 
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9(F) 

In the preferred embodiment, to gpntrm access to clearinghouses, 
users are assigned account numbers at clearinghouses. 

'193 patent at 268:29-31. 


9(G) 

information may employ, for control purposes, the same, or 
differing, granularities of electronic information control increments. 
This includes supporting variable control information for budgeting 
and auditing usage as applied to a variety ofOTedeftned increments 
of elecfronic information ir^udm| '^^^^^^^^^^^^M^M 

^^^^^^S^^S^^^St limit, 
security budget limit and security content metering increments, 
and/or market surveying and customer profiling content metering 
increments. 

'193 patent at 28:19-37. 


9(H) 

. . . support the flowing of content control information through 
different "branches" of content control information handling so as to 
accommodate, under the present invention's preferred embodiment, 
diverse controlled distributions of VDE controlled content, jpp 

instance, a party who first placed control information on content can 
make certain control assumptions and these assumptions would 
evolve into more specific and/or extensive control assumptions. 
These control assumptions can evolve during the branching 
sequence upon content model participants submitting control 
information changes, for example, for use in "negotiating" with "in 
place" content control information. This can result in new or 



35 



% t 





Claim Term / 
Phrase 


InterTrust Evidence 






modified content control information and/or it might involve the 
selection of certain one or more already "in-place" content usage 
control methods over in-place alternative methods, as well as the 
submission of relevant control information^^eter data. This 
form of evolution of ^if^^^^^^S|^^^4^^S^^^P 
m^^^O&^^^^XB^M and/or 
appliance results from VDE control information flowing "down" 
through different branches in an overall pathway of handling and 
control and being modified differently as it diverges down these 
different pathway branches. 

4 193 patent at 31:29-56. 


9(D 

concurrent business activities which are dependent on electronic 
commercial product content distribution, such as acquiring detailed 
market survey information and/or supporting advertising, both of 
which can increase revenue and result in lower content costs to users 
and greater v j*J ! ^ 

rented 

^i^^tOT 


may have the right to distribute a different array of properties than 
another distributor (from a common content collectiOTj)rovidted, for 

e)^ 

4 193 patent at 30:42-31:7. 
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9(J) 

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 

'^^^^^^^S^^^^^^^H^ For example, content 
control information for a given piece of content may be stipulated as 
senior information and therefore not changeable, might be put in 
place by a content creator and might stipulate that national 
distributors of a given piece of their content may be permitted to 
make 100,000 copies per calendar quarter, so long as such copies 
are provided to bona fide end-users, but may pass only a single copy 
of such content to a local retailers and the control information limits 
such a retailer to making no more than 1 ,000 copies per month for 
retail sales to end-users. In addition, for example, an end-user of 
such content might be limited by the same content control 
information to making three copies of such content, one for each of 
inree Qiiiereni compuicra nc ur mic uaco ^unc uwo^iup vuuipuiu «* 
work, one for a desktop computer at home, and one for a portable 
computer). 

'193 patent at 48:15-35. 


9(K) 

In thisjgx^ 

be able to establish their own control information on DA(CA) 
and/or UDB(UDA(D^^ 

example, user B may have received control information from 
user/distributor B along a chain of handling including 
user/distributor A that bases fees on the number of minutes that user 
B makes use of creator A f s content (and requiring user/distributor A 
to pay fees of $ 1 5 per month per user to distributor A regardless of 
the amount of usage by user B in a calendar month). This may be 
more favorable under some circumstances than the fees required by 
a direct use of control information provided by distributor A, but 
may also have the disadvantage of an exhausted chain of 
redistribution and, for example, further usage information reporting 
requirements included in UDB(UDA(DA(CA))). If the two sets of 
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control information DA(CA) and UDB(UDA(DA(CA))) permit (e.g. 
do not require exclusivity enforced, for example, by using a 
registration interval in an object registry used by a secure subsystem 
of user B's VDE installation to prevent deregistration and 
reregistration of different sets of control information related to a 
certain container (or registration of plural copies of the same content 
having different control information and/or being supplied by 
different content providers) within a particular interval of time as an 
aspect of an extended agreement for a chain of handling and control 
reflected in D^CA) and/or U^^JDA^AiC^}^^^^^^ 

4 193 patent at 306:30-65. 


9(L) 

For example, user/distributor A may receive control information CB 
that includes a requirement that user/distributor A pay creator B for 
content decrypted by user/distributor A (and any participant 
receiving distributed and/or redistributed control information from 
user/distributor A) at the rate of $0.50 per kilobyte. As indicated 
above, user/distributor A also may receive control information 
associated with creator B ! s VDE content container from distributor 

'193 patent at 308:29-42. 


9(M) 

As illustrated in Figure 81, in this example, t ^^Mt^M$^M 
cdntrokinfoimati 

frontainei^^ CB directly from creator B, 
DA(CB) from distributor A, UDB(UDA(DA(CB))) and/or 
UDB(UDA(CB)) from user/distributor B, DC(CB) from distributor 
C, and/or DB(DC(CB)) from distributor B. ^S^SSflSK 

alg|«e:raerit§^^^ Two of these 
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chains pass through user/distributor B. Based on a VDE negotiation 
between user/distributor B and user B, an extended agreement may 
be reached (if permitted by control information governing both 
parties) that reflects the conditions under which user B may use one 
or both sets of control information. In this example, two chains of 
handling and control may "converge" at user/distributor B, and then 
pass to user B (and if control information permits, later diverge once 
again based on distribution and/or redistribution by user B). 

4 193 patent at 308:48-65. 


9(N) 

created by creator B, creator C, and creator D in addition to one or 
more extocte ^ em b e ddedjro^ 

|^ 

presentations illustrating potential areas of interest in the remainder 
of the content, commentary explaining and/or expositing other 
elements of content, related works, improved^plication software 
delivered as an element of content, etc.); ^^^^^^^^^^^9 

and other considerations which distinguish the containers and/or 
content control information received, in this example, from 
distributor B and distributor C. 

'193 patentat 312:11-31. 


Extrinsic Sources 
9(0) 

control tr. v. -trolled, -trol-ling, -trols. 1. JI^^^^ 

maxmmmBmnasoBBM ^ synonyms * 

conduct. 2. To hold in restraint; check: struggled to control my 
temper; regulations intended to control prices. 3. a. To verify or 
regulate (a scientific experiment) by conducting a parallel 



39 





Claim Term / 
Phrase 


InterTrust Evidence 






experiment or by comparing with another standard, b. To verify (an 
account, for example) by using a duplicate register for comparison, 
-control n. 1. Authority or ability to manage or direct: lost control 
of the skidding car; the leaders in control of the country. 2. Abbr. 
cont M contr. a. One that controls; a controlling agent, device, or 
organization, b. Often controls. An instrument or set of instruments 
used to operate, regulate, or guide a machine or vehicle. 3. A 
restraining device, measure, or limit; a curb: a control on prices; 
price controls. 4. a. A standard of comparison for checking or 
verifying the results of an experiment, b. An individual or group 
used as a standard of comparison in a control experiment. 5. An 
intelligence agent who supervises or instructs another agent. 6. A 
spirit presumed to speak or act through a medium. [Middle English 
controller from Anglo-Norman contreroller, from Medieval Latin 
contr arotulare, to check by duplicate register, from contr arotulus, 
duplicate register : Latin contra-, contra- + Latin rotulus, roll, 
diminutive of rota, wheel. See ret-.]-con-trol f la-biri-ty «. -con- 
trol* la- ble adj. 

American Heritage Dictionary, 3d ed. (Houghton Mifflin, 1992), p. 410. 
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10. 


copy, copied, 
copying 

193.1,193.11, 
193.15, 193.19 


Patent Specifications 
10(A) 

In some circumstances, a VDE administrator may require that a 
:^^^^^^^^^^^) of the back up files be transmitted to it 
within an administrative object to check for indications of fraudulent 
activities by the user. 

6 193 patent at 167:63-67. 


10(B) 

When a user needs to access a particular VDE object 300, her 
electroi^^^)liance 600 ^i^^sue ^ a^re^est^^^^^^^^^^^ 

^^^^^^^^^S 300 in rel^nse to the request 
'193 patent at 226:1 1-16. 


10(C) 

Expiration dates cannot be used effectively to prevent substitution of 
the Ifl^^iiil of a budget UDE 1200. To secure these 
frequently updated items, a transaction tag is generated and included 
in the encrypted item each time that item is updated. 

'193 patent at 143:14-18. 


10(D) 

For example, author 3306A may have required that the repository 

^^^^A m or der to help maintain greater protection for content 
(e.g. in case an encryption key was "cracked" or inadvertently 
disclosed, the "damage" could be limited to the portion(s) of that 
specific copy of a certain content deliverable). 

'193 patent at 288:46-52. 
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10(E) 






electronic testing will allow users to receive a ^^^^^^^ 
^^^^^^ of their test results when they leave the test sessions. 






'193 patent at 319:13-15. 






10(F) 






transferring at least a portion of said digital file to a second device 
including a memory and an audio and/or video output, the portion of 
said digital file transferred to said second device representing a 

\/<»rcirin r*f* caiH rUcntal "filp wVlipll wVipti rPTlHprpH fit ^fliH QPfTlTlfl 
VCrolUn Ul &cUU UlgllcU lllC wiuvil, Wllvll i^iiuciwu at daiu o&i>uiiu 

device, provides a level of quality lower than the level of quality 
provided when said digital file is rendered at said first device; 






'193 patent at 323:64-324:4. 






10(G) 






For example, if the audit information received by the clearinghouse 
is legitimate, then the clearinghouse may send an administrative 

J Llod O CluVUUlllv ClJJ^llCUJVU \J\J\J ^^^^^^^^^^^^^^^^^^^^ 






4 193 patent at 162:10-15. 






10(H) 






[A] user (the "originating user") may wish to place an "originator 
controlled" ("ORCON") restriction on a certain document, such that 
the document may be transmitted and used only by those specific 
other users whom he designates (and only in certain, expressly 
authorized ways). Such a restriction may be flexible if the 
"distribution list" could be modified after the creation of the 
document snecificallv in the event ot someone-r^uestine 






'193 patent at 278:1 1-21. 
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10(1) 

ful^ * 
S^^^^^fr° m ^ e repository 200g. The distribution permissions 
3502 may, for example, permit commercial content repository 200g 
to create redistribution permissions and/or usage permissions 3500, 
3502 using a VDE protected subsystem within certain restrictions 
described in content control information received from creator 102 
(e.g., ^^^^^^^^S requiring certain 
payments by commercial content repository 200g to creator 102, 
requiring recipients of such permissions to meet certain reporting 

^^^^ 

content is placed into a VDE container as a step in a secure process 
of communicating such content to a user. 

'193 patent at 316:16-37. 


10(J) 

37. A method as in claim 36, further comprising: 

at some point after said transferring step, taking at least one action 
to render said copy of said first digital file unuseable at said second 
device; and 

at said first digital device, removing said encumbrance on said 
budget, 

said removal including increasing the number of copies of said first 
digital file authorized by said budget. 

'193 patent at 325:32-40. 


Extrinsic Sources 
10(K) 

copy ISGBSGttfB in a new location or other destination, 
leaving the source data unchanged, although the physical form of 
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the result may differ from that of the source; for example, to make a 
duplicate of all the programs or data on a disk, or to copy a graphic 
screen image to a printer. 

Spencer, Personal Computer Dictionary (Camelot Publishing, 1995), p. 47. 


10(L) 

copy 1 . The material, including text, ^^l^^ge^^ctures, and 
artwork, to be assembled for ^^ng^^^^^^^^^^P 

Webster's New World Dictionary of Computer Terms, 6th ed. (1997), p. 
118. 


10(M) 

-ies. 1. An imitation or '^^^^^8 of m original; a 
p^^^^: a copy of a painting; made two copies of the letter. 2. 
One specimen or example of a printed text or picture: an 
autographed copy of a novel 3. Abbr. c., C. Material, such as a 
manuscript, that is to be set in type. 4. The words to be printed or 
spoken in an advertisement 5. Suitable source material for 
journalism: Celebrities make good copy, -copy v. -ied, -ying, -ies 
-/r. 1. To make a reproduction or copy of 2. To follow as a model 
or pattern; imitate. See Synonyms at imitate, -intr. L To make a 
copy or copies. 2. To admit of being copied: colored ink that does 
not copy well 

American Heritage Dictionary, 3d ed. (Houghton Mifflin, 1992), p. 416. 
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11. 


derive 

900.155 


Patent Specifications 
11(A) 

Whenever CPU/SPU 2650 enters or leaves the "SPU" mode, the 
transition is performed in such a way that no information contained 
in the secure memory 532, 534 or 111111 from it (e.g., stored in 
registers or a cache memory associated with microprocessor 2652) 
while in the "SPU" mode can be exposed by microprocessor 2652 
operations that occur in the "normal" mode. 

'900 patent at 75:30-36. 


11(B) 

In some example implementations, interrupts may be enabled while 
CPU/SPU 2650 is operating in the "SPU" mode similarly interrupts 
and returns from interrupts while in the "SPU" mode may allow 
transitions from "SPU" mode to "normal" mode and back to "SPU" 
mode without exposing the content of secure memory 532, 534 or 
the content of registers or other memory associated with 
microprocessor 2652 that may contain information l^f^SI from 
secure mode operation. 

'900 patent at 75:41-49. 


11(C) 

For example, during PPE 650 operation, the internal state of the PPE 
is constantly being updated. During each interaction with a trusted 
server, PPE 650 (and the trusted server) may test the internal state 
of PPE 650 to determine whether it could be B1P from the 
internal state last seen by the trusted server for this particular PPE 
650 instance. If it could not, the result may be taken as indicating a 
replay attack of some sort, and an appropriate action can be taken 
(see Figure 69L, block 3592, 3594, 3596). 

'900 patent at 247:4-12. 


11(D) 

For example, the counter could be repeated hashing (e.g., with 



45 





Claim Term / 
Phrase 


InterTrust Evidence 






MD5) of a value that is stored redundantly in several different 
locations within the operational materials 3472 and secure database 
610 - so that the trusted server could verify that the current value 
can be 1111111 (e.g., by repeated MD5 applications) from a previous 
value. 

'900 patent at 247:20-26. 


Extrinsic Sources 
11(E) 

derive: v. de-rived, de-riv-ing, de-rives, v. tr. 1. ^p^^^^. 

derive a conclusion from facts. 3. To trace the origin or development 
of (a word). 4. Chemistry. To produce or obtain (a compound) from 
another substance by chemical reaction.v. intr. To issue from a 
source; originate. See Synonyms at steml. [Middle English deriven, 
to be derived from, from Old French deriver, from Latin derivare, to 
derive, draw off: de- y de- + rivus, stream. See rei-.J-de-rivVble 
adj. — de-riv'er n. 

American Heritage Dictionary, 3d ed. (Houghton Mifflin, 1992), p. 504. 
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12. 


designating 
721.1 


Patent Specifications 
12(A) 

Figures 1 1A-1 10 show how a verifying authority can use different 
digital signatures to PIMMI the same or different load modules as 
being appropriate for execution by different assurance level 
electronic appliances; 

'721 patent at 7:66-8:2. 


12(B) 

In one of its roles or instances, object submittal manager 774 
provides a user interface 774a that allows the user to create an 
object configuration file 1240 specifying certain characteristics of a 
VDE object 300 to be created. This user interface 774a may, for 
example, allow theus^rto specify that she wants to create an object, 
allow the user to alsifnate the content the object will contain, and 
allow the user to specify certain other aspects of the information to 
be contained within the object (e.g., rules and control information, 
identifying information, etc.). 

'193 patent at 103:11-20. 


12(C) 

Control sets 914 exist in two types in VDE 100: common required 
control sets which are given -i$$SB§$B& "control set 0" or "control 
set for right," and a set of control set options. 

'193 patent at 150:30-33. 


12(D) 

The classification attributes may 153BI the overall level of 
sensitivity of the document as an element of an ordered set. For 
example, the set "unclassified," "confidential," "secret " "top secret" 
might be appropriate in a government setting, and the set "public," 
"internal," "confidential," "registered confidential" might be 
appropriate in a corporate setting. 
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The compartment attributes may He^^^l the document's 
association with one or more specific activities within the 
organization, such as departmental subdivisions (e.g., "research," 
"development," "marketing") or specific projects within the 
organization. 

Each person using an electronic appliance 600 would be assigned, 
byan authorized user, a set of permitted sensitivity attributes to 
9esi|^p those documents, or one or more portions of certain 
document types, which could be processed in certain one or more 
ways, by the person's electronic appliance. A document's sensitivity 
attribute would have to belong to the user's set of permitted 
sensitivity values to be accessible. 

In addition, the organization may desire to permit users to exercise 
control over specific documents for which the user has some defined 
responsibility. As an example, a user (the "originating user") may 
wish to place an "originator controlled" ("ORCON") restriction on a 
certain document, such that the document may be transmitted and 
used only by those specific other users whom he l^^^tli (and 
only in certain, expressly authorized ways). 

'193 patent at 277:56-278:16. 


12(E) 

A document may have an attribute ^^^^^^ its originator and 
requiring an explicit permission to be granted by an originator 
before the document's content could be viewed. 

'193 patent at 280:1-4. 


Extrinsic Sources 
12(F) 

designate tr. v. -nated, -nating, -nates. mW^mm^m^^^m 
mmtlm. (2) mojm^^^mmm^^^^m^' (3) To select 
and set aside for a duty, an office, or a purpose. See Synonyms at 
allocate, appoint. 

American Heritage Dictionary, 3d ed. (Houghton Mifflin, 1992), p. 506. 
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13. 


device class 
721.1 


File Histories 
13(A) 

. : . Applicants respectfully submit that some of the terms cited by 
the Examiner as "indefinite" are either well-known by persons 
skilled in the art or inherently clear. For example ... the term 
"class" is used as part of the phrase "device class." pf§^|^i§ 

'721 Patent File History, 4/13/99 Response, p. 14. 
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14. 


digital signature, 
digitally signing 

721.1 


Patent Specifications 
14(A) 

A verifying authority and "certifies" Apse load 
modules or other executables it has verified (^^^^^^^^ 

Protected execution spaces such as protected processing 
environments can be programmed or otherwise conditioned to 
accept only those load modules or other executables bearing a 


'721 patent at 4:64-5:5. 


14(B) 

In accordance with another aspect provided by the present 
invention, an execution environment protects itself by deciding — 
based on digital signatures, for example — which load modules or 
other executables it is willing to execute. W^^^^^^^^^M 

process. 
'721 patent at 6:5-15. 


14(C) 

A verifying authority may digitally sign load modules or other 
executables with a digital signature that indicates or implies 
assurance level. &M®#jnMaut^^ 
tircfimques^^ 

differen%enfi^ 

mi^^m^^wS^mam^ A protected processing 
environment or other secure execution space protects itself by 
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executing only those load modules or other executables that have 
been digitally signed for its corresponding assurance level. 

'721 patent at 6:42-52. 


14(D) 

Figure 6 shows how a protected processing environment can 
securely authenticate a verifying authority's digital signature to 
guarantee the integrity of the corresponding load module; 

Figure 7 shows how several different digital signatures can be 
applied to the same load module; 

Figure 8 shows how a load module can be distributed with multiple 
digital signatures 

'721 patent at 7:47-57. 


14(E) 

i^^^^j^^^PlPIP^piHt^P^^i (RSA 
and DSA) are based on distinct mathematical problems (factoring in 
the case of RSA, discrete logs for DSA). 

'721 patent at 15:31-34. 


14(F) 

There exist many well known processes for creating digital 
signatures. One example is the Digital Signature Algorithm (DSA). 

'721 patent at 10:60-64. 
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Extrinsic Sources 
14(G) 

signature is a fonddon of: (a) the message, transaction or document 
to be signed; (b) secret information known only to the sender; and 
(c) public information employed in the validation process. 

Message authentication enables the receiver of a message to 
ensure that the contents cannot be changed accidentally or 
deliberately by a third party. However, since both the sender and 
the receiver share the same secret information there is no method of 
resolving disputes. The receiver can compute the authenticator and 
could therefore change a message, or forge a new message, develop 
the authenticator and claim that it was transmitted by the sender 
sharing the same secret key for authentication. Conversely the 
sender could disown an authenticated message and claim that the 
receiver produced a forged message using the common secret key. 

The essence of a digital signature is that the receiver must be able 
to prove that a message originated with a given sender, but must not 
be able to construct the signed message. Thus the sender requires 
secret information to construct the signed message and the receiver 
must be able to access public information for use in the validation of 
the message. In the case of a dispute the receiver must be in a 
position to supply non-secret information to a judge (i.e., the signed 
message and the publicly available information) in order to prove 
the authentication and origin of the message. Compare DYNAMIC 
PASSWORD. See MESSAGE AUTHENTICATION, PUBLIC 
KEY CRYPTOGRAPHY, RSA. Synonymous with ELECTRONIC 
SIGNATURE. 

Dictionary of Information Technology, 3d ed. (Van Nostrand Reinhold, 
1989), pp. 160-161. 


Citations from Sources Designated bv Microsoft under PLR 4-2fb) 


14(H) 

Digital signature A string of characters that can be generated only 
by an agent that knows some secret, and hence provides evidence 
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that such an agent must have generated it. 
Neumann, Computer Related Risks (ACM Press, 1995), p. 345. 


14(1) 

Another way to check your files for unauthorized tampering is to 
derive a signature for each file, and to compare that signature 
against a known value. A file signature is a function of the contents 
and nronerties of the file. A signature is relatively easy to calculate, 
but difficult to forge. 

Garfinkel et al., Practical Unix Security (O'Reilly & Associates, 1991), p. 
122. 
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15. 


executable, 
executable 
programming 

721.34,912.8, 
912.35 


Patent Specifications 
15(A) 

lllltTlb6 that contains one or more blocks of encrypted code. 

s|§ of their execution environment for efficiency and compactness. 
SPU 500 and platform providers may provide versions of the 
standard load modules 1 100 in order to make their products 
cooperate with the content in dis^ 

'193 patent at 141:42-56. 


15(B) 

iwid/or desi^implementotion methodology (e.g., Gypsy, FDM) that 
can facilitate automated analysis, validation, verification, inspection, 
and/or testing. 

'721 patent at 5:34-39. 


Extrinsic Sources 
15(C) 

executable adj. Of, pertaining to, or being a program file that can 
be run. Executable files have extensions such as .bat, .com, and 
.exe. 

executable n. A program file that can be run, such as file0.bat, 
filel.exe, or file2.com. 
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^^P^^^^Mjffll See also code (definition 1), 
compiler (definition 2), computer program, interpreter, source code. 

Microsoft Computer Dictionary, 3d ed. (Microsoft Press, 1997), p. 182. 
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16. 


host processing 
environment 

900.155 


Patent Specifications 


16(A) 

Personal computer 4 1 1 6 in this example is also provided with a 
secure processing unit 500 or ^^^^^^^^S 655 (See Figure 
12) to provide secure, tamper-resistant trusted processing. 

'683 patent at 20:16-19. 


16(B) 

uii^ and 
"SPE 503" may refer to each of them. 

'193 patent at 105:18-22; '900 patent at 1 12:48-52. 


16(C) 

As discussed above in connection with Figure 12, each electronic 
appliance 600 in the preferred embodiment includes one or more 

SPEs 5 ^J^^^^ more ^^^^^^^^^^^^^^^^ ■ 

requests passed to them by ROS 602, and they may themselves 
generate service requests to be satisfied by other services within 
ROS 602 or by services provided by another VDE electronic 
appliance 600 or computer. 

In the preferred embodiment, an SPE 503 is supported by the 
hardware resources of an SPU 500. ^^^^^^^K 

^^^^^^^^^^^^HPEiS Aus^s^Rds 602 the 
capability of assembling and executing certain component 
assemblies 690 on a general purpose CPU such as a microcomputer, 
minicomputer, mainframe computer or supercomputer processor. In 
the preferred embodiment, the overall software architecture of an 
SPE 503 may be the same as the software architecture of an HPE 
655. An HPE 655 can "emulate" SPE 503 and associated SPU 500, 
i.e., each may include services and resources needed to support an 
identical set of service requests from ROS 602 (although ROS 602 
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may be restricted from sending to an HPE certain highly secure 
tasks to be executed only within an SPU 500). 

4 193 patent at 104:39-64; '900 patent at 1 12:2-27. 


16(D) 

invention is full-featured and fully compatible with SPE 503 — that 
is, HPE 655 can handle each and every service call SPE 503 can 
handle such that the SPE and the HPE are "plug compatible" from 
an outside interface standpoint (with the exception that the HPE 
may not provide as much security as the SPE). 

* 193 patent at 79:60-80:7; '900 patent at 87:32-46. 


16(E) 

Figure 12 also shows that ROS 602 may provide one or more SPEs 
503 and/or one or more HPEs 655. As discussed above, HPE 655 
may "emulate" an SPU 500 device, and such HPEs 655 may be 
integrated in lieu of (or in addition to) physical SPUs 500 for 

systems that ^ e ^^^g^^ u P ^^yr S ^^^^^^^^^^^^ 

and may not provide truly secure processing. Thus, in the preferred 
embodiment, for high security applications at least, all secure 
processing should take place within an SPE 503 having an execution 
space within a physical SPU 500 rather than a HPE 655 using 
software operating elsewhere in electronic appliance 600. 

'193 patent at 88:31-43; '900 patent at 96:6-18. 


16(F) 

Occurrence of the control operation demonstrates that 
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microprocessor 2652 is executing in its most privileged "normal" 
mode and therefore can be trusted to execute successfully the "enter 
'SPU 1 mode" sequence of instructions stored in secure memory 532. 

there would be no assurance that those instructions would 
execute successfully. Because switch 2663 isolates microprocessor 
2652 from external signals (e.g., interrupts) until "SPU" mode is 
successfully initialized, the entry instructions can be guaranteed to 
complete successfully. 

'900 patent at 78:30-40. 


16(G) 

Designing VDE capabilities into one or more standard 
microprocessor, microcontroller and/or other digital processing 
components may materially reduce VDE related hardware costs by 
employing the same hardware resources for both the transaction 
management uses contemplated by the present invention and for 
other, host electronic appliance functions. This means that a VDE 
SPU can employ (share^^xui^el^OT^s of a "stand^^^^J. 

l^^fi for a variety of applications and the expense of a special 
purpose processor might be avoided. Under one preferred 
embodiment of the present invention, certain memory (e.g., RAM, 
ROM, NVRAM) is maintained during VDE related instruction 
processing in a protected mode (for example, as supported by 
protected mode microprocessors). 

4 1 93 patent at 2 1 : 5 -2 1 ; 6 900 patent at 21:1-17. 


16(H) 

A VDE node's hardware SPU is a core component of a VDE secure 
subsystem and may employ some or all of an electronic appliance's 
primary control logic, such as a microcontroller, microcomputer or 
other CPU arrangement. This primary control logic may be 
otherwise employed for non VDE purposes such as the control of 
some or all of an electronic appliance's non-VDE functions. When 
operating in a hardware SPU mode, said primary control logic must 
be sufficiently secure so as to protect and conceal important VDE 
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processes. ^M^^^^H 

thus allowing portions of 
VDE processes to execute with a certain degree of security. This 
alternate embodiment is in contrast to the preferred embodiment 
wherein a trusted environment is created using a combination of one 
or more tamper resistant semiconductors that are not part of said 
primary control logic. 

' 193 patent at 49:33-50; '900 patent at 49:31-48. 
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17. 


identifier 

193.15,912.8 


Patent Specifications 


17(A) 

This same termination (or other specified consequence such as 
budget reduction, price increase, message displays on screen to 
users, messages to administrators, etc.) can also be the consequence 
of the failure by a user or the users VDE installation to complete a 
monitored process, such as paying for usage in electronic currency, 
failure to perform backups of important stored information (e.g., 
content and/or appliance usage information, control infonmtion, _ 
etc.), failure to use a repeated failure to use the proper ^^^^^^ 

'193 patent at 270:12-21 


17(B) 

During the same or different communication session, the terminal 
could similarly, securely communicate back to the portable 
appliance 2600 VDE secure subsystem details as to the retail 
transaction (for example, what was purchased ar^rice, the retail 
establishment's digital signature, the ^^^^^pIS^^^, tax 
related information, etc.). 

'193 patent at 233:35-41. 


17(C) 

different SPE instruction sets as well as different user platforms, and 
allows methods to be constructed without dependencies on the 
underlying load module instruction set. 

'193 patent at 140:37-50. 
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17(D) 






[VDE features] provide very jBje^ffl^ag^^gMiBh^^^ 
ift^^^^ according to individuals, installations, ^^^^^ such 
as classes, and by function and hierarchical identification employing 
a hierarchy of levels of client identification (for example, client 
organization ID, client department ID, client network ID, client 
project ID, and client employee ID, or any appropriate subset of the 

aUUVCJ. 






'193 patent at 25:31-38. 






17(E) 






Account Numbers and User IDs 

In the preferred embodiment, to control access to clearinghouses, 
users are assigned account numbers at clearinghouses. Account 
numbers provide a unique "instance" value for a secure database 
record from the point of view of an outsider. From the point of view 
of an electronic appliance 600 site, the user, group, or group/user ids 
provide the unique instance of a record. For example, from the 
point of view of VISA, your Gold Card belongs to account number 
#123456789. From the point of view of the electronic appliance site 
(for example, a server at a carooration^, the Gold card might belong 
to user id 1023. ^^^^^^^^B^^^B^^^R^^I 
iflHHi using a VDE node, such users andJor^^m^^M 

S^^^^^sf^^j^^^iP^^^^S 






17 J pcLlCIH al ZuO.^O**tX. 






Extrinsic Sources 






17(F) 






identify v. identffi^ 

'^^^^^^^^3. Ewl^f. ^^rmiiie the taxonomic 
classification of (an organism). 4. To consider as identical or united; 
equate. 5. To associate or affiliate (oneself) closely with a person or 
group.v. intr. To establish an identification with another or 
others, [Medieval Latin identificare, to make to resemble : Late Latin 
identitas, identity. See IDENTITY + Latin -ficare, -fy.]-i-den f ti- 
fi'a-ble adj. -i-den'ti-fi'a-bly adv. -i-den'ti-fTer n. 






American Heritage Dictionary, 3d ed. (Houghton Mifflin, 1992), p. 896. 
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18. 


protected 

processing 

environment 


Patent Specifications 


18(A) 




683.2, 721.34 


Because security may be better/more effectively enforced with the 
assistance of hardware security features such as those provided by 
SPU 500 (and because of other factors such as increased 
performance P "J|^ 

1 93 patent 80:65-8 1:8. 






18(B) 

The Ginter et al. patent disclosure describes, among other things, 












'721 patent 3:16-21. 






18(C) 






One particular example of a secure execution space is a "protected 
processing environment" 108 of the type shownmjjinter et .al. (see 
Figures 6-12) and described in associated text^^^^^plf^^S 






'721 patent 8:33-40. 






18(D) 






In this example, appliance 600 may include one or more processors 
4126 providing or supporting one or more M prot^ted|p)^cje§sisg 
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302. In this particular example, secure containers 302 may not be 
opened except within a protected processing environment 650. 
Protected processing environment 650 is provided with the 
cryptographic and other information it needs to open and manipulate 
secure containers 302, and is tamper resistant so that an attacker 
cannot easily obtain and use this necessary information. 

'683 patent 29:51-30:3. 



18(E) 



Figure 10 is a block diagram of one example of a software^ 
structure/architecture for Rights Operating System ("ROS") 602 
provided by the preferred embodiment. In this example, ROS 602 
includes an operating system ("OS") "core" 679, a user Application 
Program Interface ("API") 682, a "redirector" 684, an "intercept" 
692, a User Notification/Exception Interface 686, and a file system 

687! ROS 602 in this example a }li , J n ^ u ^| 3 °^S^S^& 
Event Processing Environments]™" - > ■ - • - ~ - 




m For example, they may each 
perform secure processing based on one or more VDE component 
assemblies 690, and they may each offer secure processing services 
to OS kernel 680. 
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500 provides the hardware tamper-resistant barrier 503 surrounding 
SPE 503. SPE 503 provided by the preferred embodiment is 
preferably: 

small and compact 

loadable into resource constrained environments such as for 

example minimally configured SPUs 500 

dynamically updatable 

extensible by authorized users 

integratable into object or procedural environments 

secure. 




j, such as 



►ose 




for example an electronic appliance CPU 654 general-pi 
microprocessor or other j 

Ufa 
si 



^ >jmw ^^ HPE 655 in one preferred embodiment of the present 
invention is full-featured and fully compatible with SPE 503 — that 
is, HPE 655 can handle each and every service call SPE 503 can 
handle such that the SPE and the HPE are "plug compatible" from 
an outside interface standpoint (with the exception that the HPE 
may not provide as much security as the SPE). 



For example, it may be desirable to provide non-secure versions of 
HPE 655 to allow electronic appliance 600 to efficiently run non- 
sensitive VDE tasks using the fall reso ^ces£^^tjener^ 
purpose processor or computer. §^<Sapl 




'193 patent 79:24-80:21. 



18(F) 
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4 193 patent 105: 15-20. 






18(G) 






and where commercially acceptable, certain 

VDE participants, sucn as cleanngnouses max normally maintain 
sufficiently physically secure non-VDE processing environments, 
may be allowed to employ HPEs rather VDE hardware elements and 
interoperate, for example, with VDE end-users and content 
providers. 






'193 patent 13:17-23. 






18(H) 






An end user may make use of credit and/or currency securely stored 
within the end user's VDE installation secure subsystem to pay for 
charges related to use of VDE content received from the repository, 
and/or the user may maintain a secure credit and/or currency 
account remotely at the repository, including a "virtual" repository 
where payment is made for the receipt of such content by an end 
user. This later approach may provide greater assurance for 
j^^^^to the regositor^ l^^^^^^^J^^^ ^^M^iSSI 






'193patent291:39-49. 






18(1) 






@n##a#0jme™ensi&efe 
ififinllS 

fBS^3iM§«HlilBllB 

fflll This arrangement reqxxires no hardware modification of the 
workstations; an HPE 655 can be defined using software only. An 
SPE(s) 503 and/or HPE(s) 655 could also be provided within a VDE 
server. This arrangement has the advantage of allowing distributed 
VDE network processing without requiring workstations to be 
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customized or modified (except for loading a new program(s) into 
them). VDE functions requiring high levels of security may be 
restricted to an SPU-based VDE server. "Secure" HPE-based 
workstations could perform VDE functions requiring less security, 
and could also coordinate their activities with the VDE server. 

c 193 patent 226:43-57. 


18(J) 

Large Organization Example 

In a somewhat more general example, suppose an organization (e.g., 
a corporation or government department) with thousands of 
employees and numerous offices disposed throughout a large 
geographic area wishes to exercise control over distribution of 
information which belongs to said organization (or association). 

'193 patent 277:26-32. 


18(K) 

User Environment 

In an organization (or association) such as that described above, 
users may utilize a variety of electronic appliances 600 for 
processing and managing documents. This may include personal 
computers, both networked and otherwise, powerful single-user 
workstations, and se ^^ 

PPE 650 are used within an organization to serve different 
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requirements, they may be compatible and may operate on the same 
types (or subsets of types) of documents. 






* 193 patent 278:45-65. 






18(L) 

This manufacturing process may include, gSHZS^B* ^ es ^ n g ^ e 
bootstrap loader and challenge-response software permanently 
stored within PPE 650, and P^a^^^li^ 

4 193 patent 223:36-39. 












18(N) 

'193 patent at 221:2-6. 






18(0) 

succeed in such a "brute force attack" substantially exceeds any 
value to be derived. In addition, the security provided by VDE 100 
compartmentalizes the internal workings of VDE so thatj[ 
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'193 patent at 199:38-46. 


18(P) 

VDF sunnorts K^^^^S electronic information 
distribution and visage control models for both commercial 
electronic content distribution and data security applications. 

4 193 patent at 16:25-28.. 


18(Q) 

1 . A security method comprising: 

(a) digitally signing a first load module with a first digital signature 
designating the first load module for use by a first device class; 

(b) digitally signing a second load module with a second digital 
signature different from the first digital signature, the second digital 
signature designating the second load module for use by a second 
device class having at least one of tamper resistance and security 
level different from the at least one of tamper resistance and security 
level of the first device class; 

(c) distributing the first load module for use by at least one device in 
the first device class; and 

(d) distributing the second load module for use by at least one 
device in the second device class. 

'721 patent at 21:9-24. 


18(R) 

34. A protected processing environment comprising: 

a first tamper resistant barrier having a first security level, 

a first secure execution space, and 
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at least one arrangement within the first tamper resistant barrier that 
prevents the first secure execution space from executing the same 
executable accessed by a second secure execution space having a 
second tamper resistant barrier with a second security level different 
from the first security level 

'721 patent at 24:48-56. 


18(S) 


usine a collection of techniaues that minimizes the damage resulting 
from comprising some aspect of the security features of the present 
inventions. 

'193 patent at 35:59-63. 


18(T) 

Fingerprinting electronic content before it is encrypted for transfer 
to a customer or other user provides information that can be very 
useful for identifying who received certain content which may have 
then been distributed^r^miad 

'193 patent at 38:4-12. 


18(U) 

If a content key becomes con^omised^^^l^^^PSSi 
W^^SS^^S^I^^^^Sm^^^^m^$ until the key "ages" and 

expires. Mmmm^mB^M^X^WBW^S^^> 
'193 patent at 222:49-53. 
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18(V) 

^^^^^^^^^^^^^^^^^^^ ^ may 
be updated with an initialization to use ^wcode^keys and new 
encryption/decryption algorithms. fflti^^Mll^^^^l^^^^^ 


6 193 patent at 223:4-10. 


18(W) 

communications, systems integration software, and distributed 
software control information and support structures, to achieve the 
electronic contract/rights protection environment of the present 
invention. 

'193 patent at 13:7-14. 


File Histories 
18(X) 

... the Examiner objects to the use of "environment" as indefinite 
and unclear. This word, however, is not used in isolation, but rather 
in the context of several longer phrases, all of which are defined in 
the specification. The phrase "protected processing environment," 
for example, is . . . described on at least, for example, pages 7-8 and 

25 of the specification These terms are also described in the 

commonly assigned copending application . . . filed 13 February 
1995. 

'721 Patent File History, 4/13/99 Amendment, p. 13. 
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Citations from Sources Designated bv Microsoft under PLR 4-20)) 


18(Y) 

Furthermore, there is never an absolute sense in which a system is 
secure or reliable. 

Neumann, Computer Related Risks (ACM Press, 1995), p. 2. 


18(Z) 

from (1) physical damage or destruction, (2) human errors and 
omissions, and (3) theft or unauthorized disclosure. That purpose is 
best fulfilled by effective loss-prevention efforts. Loss-prevention 
efforts involve the identification and assessment of risks to capital, 
human, informational, and technological assets, and the 
development of suitable and cost-feasible countermeasures. 

Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 75. 


18(AA) 

^^^^^^^^^^^^^ ^^ly skilled^ programmer can almost 
always penetrate software safeguards written by another 
programmer. Of course, the same can be said for attorneys; an 
unprincipled lawyer can usually get around protections in a 
contract written by an-other lawyer. Yet contracts continue to be 
written, and, for the most part, they are effective. Computer 
software security routines can also be effective most of the time. f§ 
secura®©Meeto 

11 18 certainly 

worthwhile. The basic consideration is one of degree— how 
important are specific elements of data and software, and how 
important is their security. Some data require very little security. 
For example, a software library containing programs that are 
similar to those found in many other computer installations does 
not require elaborate security protection against theft. On the other 
hand, proprietary programs and sensitive data require extensive 
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security. A data base containing payroll information requires 
stringent security procedures to maintain its confidentiality. 

Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 201, 


18(BB) 

Regardless of which form of data storage is b^|considere^^^ 
Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 218. 


18(CC) 




effective systems apply security protection techniques in layers. 
Each layer of protection diminishes the chances of someone 
breaking through the barriers. 

Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1 988), pp. 
293. 


18(DD) 

Risk analysis is not ^ ten d e dtocame up with apjaa forab^lute 
security. Indeed, ^^ffSKBK^S^BSSBUSBM 
B^^^^^ Rather, risk analysis produces a degree of 
security commensurate with the information to be protected and 
with the amount of resources to be expended. 

Hoffman, Modern Methods for Computer Security and Privacy (Prentice- 
Hall, 1977), p. 170. 


18(EE) 

^^^^^^^^^^^^^^^^W cSjiiters 
are especially vulnerable because software is complex and we don't 
always know if there are flaws present that make the task of 
breaking in easier. Even systems that are certified according to the 
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Department of Defense's so-called Orange Book are vulnerable, 
especially if they are not administered correctly. Just as six-foot- 
thick vaults doors don't work if they're not administered properly. 

Garfinkel et al., Practical Unix Security (O'Reilly & Associates, 1991), pp. 
13. 


18(FF) 

l^^^S^^^l^^S and gains in security 
often come only with penalties in performance. 

Landwehr, Formal Models for Computer Security, ACM Computer Surveys 
(Sept. 3, 1981), p. 253. 
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19. 


secure, securely 

193.1, 193.11, 
193.15, 861.58, 
891.1,683.2, 
721.34,912.8, 
912.35 


Patent Specifications 
19(A) 

VDE normally employs an integratiqn_of^^te^ffimgma^^ 

with 

other technologies 

4 193 patent 8:1-3. 


19(B) 

Sin,e VDF. also emplovs mMB^^» 
communications when passing information between the participant 
location (nodes) secure subsystems of a VDE arrangement, 
important components ^^^^^leg^p^^e^^^^^^^^ 

'193 patent 45:39-45. 


19(C) 

'193 patent 21:26-29. 


19(D) 

ithl^ 

accepted as valid transaction records for government and/or 
corporate recordkeeping requirements. 

'193 patent 41:37-42. 
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19(E) 






SPU 500 is enclosed within and protected by a 'tamper resistant 
security barrier" 502. Security barrier 502 separates the secure 
environment 503 from the rest of the world. It prevents information 
and processes within the secure environment 503 from being 
observed, interfered with and leaving except under appropriate 
secure conditions. Barrier 502 also controls external access to 
secure resources, processes and information within SPU 500. In one 
example^toniper resistant security ^^^^^^^^^^^^^M 






'193 patent 59:48-59. 






19(F) 






VDE 100 stores separately deliverable VDE elements in a 111111 
j^jfiSlii database 610 distributed to each VDE electronic 
appliance 610. 






'193 patent 126:6-8. 






19(G) 












'193 patent 126:30-31. 






19(H) 






In oneyem^^ 

communications with a retail terminal which may contain a VDE 
electronic appliance 600 or communicate with a retailer's or third 
party provider's VDE electronic appliance 600. 






'193 patent 233:25-30. 
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19(1) 

Information could then be automatically "parsed" and routed into 
mmmmm$%nmSmm appropriate database 
management records within portable appliance 2600. 

'193 patent 233:5 1-54. 


19(J) 

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
'193 patent at 49:59-62. 


19(K) 

'193 patent at 221:2-6. 


19(L) 

VDE 100 provided by the preferred embodiment has l^KpBl 

'se1s»mfoelp5er^^ 

■■BHMHMrS 1 . to .he tin* and cos. «o 

succeed in such a "brute force attack" substantially exceeds any 
value to be derived. In addition, the security provided by VDE 100 
compartmentalizes the internal workings of VDE so that |j 

'193 patent at 199:38-46. 


19(M) 

VDE supports i^^^^lfigW^lp^^^) electronic information 
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distribution and usage control models for both commercial 
electronic content distribution and data security applications. 

493 patent at 16:25-28. 


19(N) 

Because security may be better/more effectively enforced with the 
assistance of hardware security features such as those provided by 
SPU 500 (and because of other factors such as increased 
performance grovided^^sgec^^r^e c ^ r ^^^^^ n 5®p\ 

StmHtifeand/or the cost of an SPU 500 cannot be tolerated, mB$g& 
4 193 patent at 80:65-81:8. 


19(0) 

1. A security method comprising: 

(a) digitally signing a first load module with a first digital signature 
designating the first load module for use by a first device class; 

(b) digitally signing a second load module with a second digital 
signature different from the first digital signature, the second digital 
signature designating the second load module for use by a second 
device class having at least one of tamper resistance and security 
level different from the at least one of tamper resistance and security 
level of the first device class; 

(c) distributing the first load module for use by at least one device in 
the first device class; and 

(d) distributing the second load module for use by at least one 
device in the second device class. 

'721 patent at 21:9-24. 
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19(P) 

34. A protected processing environment comprising: 

a first tamper resistant barrier having a first security level, 

a first secure execution space, and 

at least one arrangement within the first tamper resistant barrier that 
prevents the first secure execution space from executing the same 
executable accessed by a second secure execution space having a 
second tamper resistant barrier with a second security level different 
from the first security level. 

'721 patent at 24:48-56. 


19(Q) 

using a collection of techniques that minimizes the damage resulting 
from comprising some aspect of the security features of the present 
inventions. 

4 193 patent at 35:59-63. 


19(R) 

Fingerprinting electronic content before it is encrypted for transfer 
to a customer or other user provides information that can be very 
useful for identifying who received certain content which may have 
then been distributed or made available in unencrypted form.^81 

'193 patent at 38:4-12. 


19(S) 

If a content key becomes compromise<^^^||^^^^^H 
mmaPn^HM until the key "ages" and 
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expires. 
'193 patent at 222:49-53. 


19(T) 

^ may 


be updated with an initialization to use new code, keys and new 

enci^^jt^n/d^^rj^j^^on algorithms, i!^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 

4 193 patent at 223:4-10. 


Extrinsic Sources 
19(U) 

security The protection of valuable assets stored on computer 
systems or transmitted via computer networks. Computer security 
involves the following conceptually differentiated areas: 

• Authentication (ensuring that users are indeed the persons 
they claim to be). 

• Access control (ensuring that users access only those 
resources and services that they are entitled to access). 

• Confidentiality (ensuring that transmitted or stored data is 
not examined by unauthorized persons). 

• Integrity (ensuring that transmitted or stored data is not 
altered by unauthorized persons in a way that is not 
detectable by authorized users). 

• Nonrepudiation (ensuring that qualified users are not 
denied access to services that they legitimately expect to 
receive and that orieinators of messages cannot denv that 
they in fact sent a given message). 

Webster's New World Dictionary of Computer Terms, 6th ed. (1997), p. 
463. 
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Citations from Sources Designated bv Microsoft under PLR 4-2(b) 


19(V) 

In common technical usage, however, computer security and 
communication security generally refer to protection against human 
misuse, and exclude the protection against malfunctions. 

Neumann, Computer Related Risks (ACM Press, 1995), p. 96. 


19(W) 

There is a fifth important attribute of dependability — the security 
attribute — that cannot be measured easily: the ability of a system to 
prevent unauthorized access or handling of information. 

Mullender, Distributed Systems, 2nd ed. (Addison- Wesley, 1993), p. 420. 


19(X) 

Furthermore, there is never an absolute sense in which a system is 
secure or reliable- 
Neumann, Computer Related Risks (ACM Press, 1995), p. 2. 


1900 

from (1) physical damage or destruction, (2) human errors and 
omissions, and (3) theft or unauthorized disclosure. That purpose is 
best fulfilled by effective loss-prevention efforts. Loss-prevention 
efforts involve the identification and assessment of risks to capital, 
human, informational, and technological assets, and the 
development of suitable and cost-feasible countermeasures. 

Hutt et al, Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 75. 


19(Z) 

Wc&^MM!^ A highly skilled programmer can almost 
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always penetrate software safeguards written by another 
programmer. Of course, the same can be said for attorneys; an 
unprincipled lawyer can usually get around protections in a 
contract written by an-other lawyer. Yet contracts continue to be 
written, and, for the most part, they are effective. Computer 
software security joi^^ 8 

worthwhile. The basic consideration is one of degree — how 
important are specific elements of data and software, and how 
important is their security. Some data require very little security. 
For example, a software library containing programs that are 
similar to those found in many other computer installations does 
not require elaborate security protection against theft. On the other 
hand, proprietary programs and sensitive data require extensive 
security. A data base containing payroll information requires 
stringent security procedures to maintain its confidentiality. 

Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 201. 


19(AA) 

Regardless of which form of d^^storag^s^^^^^^^^^^^p 
Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 218. 


19(BB) 

^M^^^^»^^^^^SThe most 
effective systems apply security protection techniques in layers. 
Each layer of protection diminishes the chances of someone 
breaking through the barriers. 

Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), pp. 
293. 


19(CC) 

Risk analysis is not intended to come up with a planfora^solute 
security. Indeed, "^^MM^^^^m^^Mi^^^^M^M 
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^^^Sl^^^^^^ Rather, risk analysis produces a degree of 
security commensurate with the information to be protected and 
with the amount of resources to be expended. 

Hoffman, Modern Methods for Computer Security and Privacy (Prentice- 
Hall, 1977), p. 170. 


19(DD) 

^^^^^^^S^^^^^^^^^^^^S' Computers 
are especially vulnerable because software is complex and we don't 
always know if there are flaws present that make the task of 
breaking in easier. Even systems that are certified according to the 
Department of Defense's so-called Orange Book are vulnerable, 
especially if they are not administered correctly. Just as six-foot- 
thick vaults doors don't work if they're not administered properly. 

Garfinkel et al., Practical Unix Security (O'Reilly & Associates, 1991), pp. 
13. 


19(EE) 

^SMM^M^^mfM^^M^S, and gains in security 
often come only with penalties in performance. 

Landwehr, Formal Models for Computer Security, ACM Computer Surveys 
(Sept 3, 1981), p. 253. 
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20. 


secure container 

912.35, 861.58, 
683.2 


Patent Specifications 


20(A) 

|^ C^et^^ 
typically includes identifying information, contt^^^ttires and 

'193 patent 127:30-49. 


20(B) 

VDE, in its preferred embodiment, employs objectjo^are^ 

tecbiiologv^j^obj^nech^^^^^^^^^^^^© 

^^^^^^^^^w^^m^^^t\sc^ac content 
products or other electronic information and some or all ot then- 
associated permissions (control) information. These container 
objects may be distributed along pathways involving content 
providers and/or content users. They may be securely moved 
among nodes of a Virtual Distribution Environment (VDE) 
arrangement, which nodes operate VDE foundation software and 
execute control methods to enact electronic information usage 
control and/or administration models. The containers delivered 
through use of the preferred embodiment of the present invention 
mav be employed both for distn outing VJJc. control im^mou^ 
(Jormation)and/or®^mp^PMfflW 

'193 patent 13:54-14:4. 



83 



% i 





Claim Term / 
Phrase 


InterTrust Evidence 






20(C) 

Figure 88 illustrates secure electronic container 302 as an attache 
case handcuffi^^ 

so t]^ recipient 405^^^ 

access the electronic document (or other item) 4054 it contains. 
'683 patent 15:61-16:4. 


________-__^^^===^=========^^ 

20(D) 

The Figure 5 A example shows items 4t within" and enclosed by 
'193 patent 58:48-58. 


20(E) 

The term "container" is often (e.g., Bento/OpenDoc and OLE) used 
to describe a collection of information stored on a computer 
system's secondary storage system(s) or accessible to a computer 
system over a communications Jj|^^ 

^^^^^^^^^^^^^^^ 
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wmwiwwMmmmiissazm!^ The "logical object" may exist over a 
particular period of time (or periods of time), rather than all at once. 
This concept includes the notion of a "virtual container" where 
important container elements may exist either as a plurality of 
locations and/or over a sequence of time periods (which may or may 
not overlap). Of course, VDE 100 containers can also be|tored 

"""" ° " " si 




'193 patent 127:35-62. 



20(F) 




In order to improve perjformance. 



'683 patent 53:3-5. 



20(G) 



In more detail, the logical object structure 800 provided by the 
^^^^^^^^^gincludes a public (or unencrypted) header 
802 that identifies the object and may also identify one or more 
owners of rights in the object andj^r^ OTmored^ri^^r^f&e 
Object. &«i»alMfiMa^MB^ 



~-«_J wth a service clearinghouse, VDE aciministrator, or an 
SPU^Or Alternatively, information identifying.... 



'193 patent 128:11-21. 
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20(H) 

Third party go-between can authenticate an item by, for example, 
|^^^^^^^^^^^^^^^^) one or more containers 

'683 patent 9:59-61. 


Extrinsic Sources 
20(1) 

container «. 1. In OLE terminology, ^P^^^l^^^^^^^ 
em^llfa|§ijel§. See also OLE. 2. In SGML, an element that has 

content as opposed to one consisting solely of the tag name and 
attributes. 

Microsoft Computer Dictionary, 3d, ed. (Microsoft Press, 1997), p. 1 15. 


20(J) 

In a preferred embodiment of the present invention, an application 
program that creates a compound document controls the 
manipulation of linked or embedded data generated by another 
application. In object-oriented parlance, this data is referred to as an 
object. (The reference Budd, T., "An Introduction to Object- 
Oriented Programming," Addison- Wesley Publishing Co., Inc., 
1991, providesa^ 

obj ects a compound document are referred to as 
"contained" or "containee 11 objects. Referring to FIGS. 1 and 2, the 
scheduling data 102 and budgeting data 103 are containee objects 
and the compound document 101 is a container object. 

USP 5,634,019 at 7:34-49. 
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21. 


tamper 
resistance 

721.1 


Poland CnA/kifiAo^iAii6 
I altlll opeilllCdilUIla 

21(A) 

Maintaining shared secrets (e.g., cryptographic keys) within a 


4 721 patent at 4:40-42. 


21(B) 

SPU 500 is enclosed within and protected by a "tamper resistant 
security barrier" 502. Security barrier 502 separates the secure 
environment 503 from the rest of the world. It prevents information 
and processes within the secure environment 503 from being 
observed, interfered with and leaving except under appropriate 
secure conditions. Barrier 502 also controls external access to 
secure resour^^^o^ 

^^^^^^^^^^^^^^^^^^^^n secure'^ 
when tampering is detected. 

'193 patent at 59:48-59. 


Extrinsic Sources 
21(C) 

To evaluate the results of physically protecting portions of the 
system, the concept of a tamper-resistant module (TRM) is 
intr^ 

ilL^as tii^ 

TRMs will vary considerably depending on the value of the external 
software being protected and the perceived sophistication of 
potential attackers. 

Kent, Protecting Externally Supplied Software in Small Computers, 
Doctoral Thesis (Sept. 22, 1980), p. PA00000363. 
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21(D) 




attack. Our approach has been to classify attacks into three 
categories and then to develop a series of software design principles 
that allow a scaled response to those threats. 

Aucsmith, Tamper Resistant Software: An Implementation (1996), p. 
PA00002323. 



Mambo et al., A Tentative Approach to Constructing Tamper-Resistant 
Software, School of Information Science, Japan Advanced Institute of 
Science and Technology, 1-1 Asahidai Tatsunokuchi Nomi, Ishikawa 
(1997), p. PA00005363. 



21(E) 



Moreover tamper-resistance enables a vendor to enforce his own 




conditions upon users. 
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721.34 



InterTrust Evidence 
Patent Specifications 
22(A) 

SPU 500 is enclosed within and protected by a "tamper resistant 
security barrier" 502. Security barrier 502 separates the secure 
environment 503 from the rest of the world. It prevents information 
and processes within the secure environment 503 from being 
observed, interfered with and leaving except under appropriate 
secure conditions. Barrier 502 also controls external access to 
secure resources, processes and information within SPU 500. In one 
example, tamper resistant security barrier 502 is formed by security 
features such as "encryption," and hardware that detects tampering 
and/or destroys sensitive information within secure environment 503 
when tampering is detected. 

'193 patent 59:48-59. 



22(B) 



HPEs 655 may (as shown in Figure 10) be provided with a j 
p^pg^ ppmiSIIMi 674 that makes them more secure. 
Such ^ftware-based tamper resistant barrier 674 may be created 
by software executing on general-purpose CPU 654. Such a 
"secure" HPE 655 can be used by ROS 602 to execute processes 
that, while still needing security, may not require the degree of 
security provided by SPU 500. This can be especially beneficial in 
architectures providing both an SPE 503 and an HPE 655. The SPU 
502 may be used to perform all truly secure processing, whereas one 
or more HPEs 655 may be used to provide additional secure (albeit 
possibly less secure than the SPE) processing using host processor 
or other general purpose resources that may be available within an 
electronic appliance 600. Any service may be provided by such a 
secure HPE 655. In the preferred embodiment, certain aspects of 
"channel processing" appears to be a candidate that could be readily 
exported from SPE 503 to HPE 655. 

The software-based tamper resistant barrier 674 provided by HPE 
655 may be provided, for example, by: introducing time checks 
and/or code modifications to complicate the process of stepping 
through code comprising a portion of kernel 688a and/or a portion 
of component assemblies 690 using a debugger; using a map of 
defects on a storage device (e.g., a hard disk, memory card, etc.) to 
form internal test values to impede moving and/or copying HPE 655 
to other electronic appliances 600: using kernel code tha t contains 
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false branches and other complications in flow of control to disguise 
internal processes to some degree from disassembly or other efforts 
to discover details of processes; using "self-generating" code (based 
on the output of a co-sine transform, for example) such that detailed 
and/or complete instruction sequences are not stored explicitly on 
storage devices and/or in active memory but rather are generated as 
needed; using code that "shuffles" memory locations used for data 
values based on operational parameters to complicate efforts to 
manipulate such values; using any software and/or hardware 
memory management resources of electronic appliance 600 to 

etc. 




'193 patent 80:22-65. 



22(C) 



Protected execution spaces such as protected processing 
environments can be programmed or otherwise conditioned to 
accept only those load modules or other executables bearing a 
digital signature/certificate of an ac^ea^tedfo^^c^^er 



ying 



'721 patent 5:1-6. 
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use 

912.8,912.35, 
861.58, 193.19, 
891.1,683.2, 
721.1 



InterTrust Evidence 



Extrinsic Sources 



23(A) 



use v. used, us-ing, us-es. tr. 1. ^^m^Sm^SS^Wm& 
Pp pgj , 2. To avail oneself of; practice: use caution. 3. To 
c^nductoneself toward; treat or handle: "the peace offering of a 
man who once used you unkindly" (Laurence Sterne). 4. To seek or 
achieve an end by means of; exploit: used their highly placed 
friends to gain access to the president; felt he was being used by 
seekers of favor. 5. To take or consume; partake of: She rarely used 
alcohol, -intr. (yoos, yoost). Used in the past tense followed by to 
in order to indicate a former state, habitual practice, or custom: Mail 
service used to be faster, use (yoos). n. 1. a. The act of using; the 
application or employment of something for a purpose: with the use 
of a calculator; skilled in the use of the bow and arrow, b. The 
condition or fact of being used: a chair in regular use. 2. The 
manner of using; usage: learned the proper use of power tools. 3. a. 
The permission, privilege, or benefit of using something: gave us 
the use of their summerhouse. b. The power or ability to use 
something: lost the use of one arm. 4. The need or occasion to use or 
employ: have no use for these old clothes. 5. The quality of being 
suitable or adaptable to an end; usefulness: tried to be of use in the 
kitchen. 6. A purpose for which something is used: a tool with 
several uses; a pretty bowl, but of what use is it? 7. Gain or 
advantage; good: There's no use in discussing it. What's the use? 8. 
Accustomed or usual procedure or practice. 9. Law. a. Enjoyment 
of property, as by occupying or exercising it. b. The benefit or 
profit of lands and tenements of which the legal title and possession 
are vested in another, c. The arrangement establishing the equitable 
right to such benefits and profits. 10. A liturgical form practiced in a 
particular church, ecclesiastical district, or community. 11. 
Obsolete. Usual occurrence or experience, -phrasal verb, use up. 
To consume completely: used up all our money. [Middle English 
usen, from Old French user, from Vulgar Latin *usare, 
frequentative of Latin uti. ] 

SYNONYM: use, employ, utilize. These verbs mean to avail oneself 
of someone or something in order to make him, her, or it useful, 
functional, or beneficial. To use is to put into service or apply for a 
purpose: uses a hearing aid; used the press secretary as 
spokesperson for the administration; using a stick to stir the paint. 
Employ is often interchangeable with use: She employed her 
education to maximum advantage. Unlike use, however, the term 
can denote engaging or maintaining the services of another or 
putting another to work: "When men are employed, they are best — 
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contented" (Benjamin Franklin). Utilize is especially appropriate in 
the narrower sense of making something profitable or of finding 
new and practical uses for it: In the 19th century waterpower was 
widely utilized to generate electricity. See also Synonyms at habit. 

American Heritage Dictionary, 3d ed. (Houghton Mifflin, 1992), p. 1966. 
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24. 


virtual 

distribution 

environment 

900.155 


Patent Specifications 
24(A) 

'193 patent at 9:36-39; '900 patent at 9:33-36. 


24(B) 

Electronic appliances such as computers employed in accordance 
with the present invention help to ensure that information is 
accessed and used only in authorized ways, and maintain the 

integrity, ^"^^^^"'^^P^^^^^^^^^^^P 
'900 patent at Abstract. 


24(C) 

Figure 1 shows a "Virtual Distribution Environment" ("VDE") 1 00 
that may be provided in accordance with this invention. In Figure 1, 
an information utility 200 connects to communications means 202 
such as telephone or cable TV lines for example. Telephone or 
cable TV lines 202 may be part of an "electronic highway" that 
carries electronic information from place to place. Lines 202 
connect information utility 200 to other people such as for example 
a consumer 208, an office 210, a video production studio 204, and a 
publishing house 214. Each of the people connected to information 
utility 200 may be called a "VDE participant" because they can 
participate in transactions occurring within the virtual aistnouuon 
environment 100. 

Almost any sort of transaction you can think of can be supported by 
virtual distribution environment 1 00. A few of many examples of 
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transactions that can be supported by virtual distribution 
environment 100 include: 

home banking and electronic payments; 
electronic legal contracts; 

distribution of "content" such as electronic printed matter, video, 
audio, images and computer programs; and 
secure communication of private information such as medical 
records and financial information. 




For example, in the past, information was distributed on records or 
disks that were difficult to copy. In the past, private or secret 
content was distributed in sealed envelopes or locked briefcases 
delivered by courier. To ensure appropriate compensation, 
consumers received goods and services only after they handed cash 
over to a seller. Although information utility 200 may deliver 
information by transferring physical "things" such as electronic 
storage media, the virtual distribution environment 100 facilitates a 
completely electronic "chain of handling and control." 



'193 patent at 52:66-53:37; '900 patent 53:39-54:10. 



24(D) 



Because security may be better/more effectively enforced with the 
assistance of hardware security features such as those provided by 
SPU 500 (and because of other factors such as increased 




'193 patent 80:65-67-81:8. 



94 



% 



Claim Term / 
Phrase 



InterTrust Evidence 



24(E) 



An end user may make use of credit and/or currency securely stored 
within the end user's VDE installation secure subsystem to pay for 
charges related to use of VDE content received from the repository, 
and/or the user may maintain a secure credit and/or currency 
account remotely at the repository, including a "virtual" repository 
where payment is made for the receipt of such content by an end 
user. This later approach may provide greater assur^^e^^ 
^vment^^e^^tory a^^^o^g i Provjders p a " ar 



193 patent at 291:39-49; '900 patent 316:35-45. 



24(F) 



Large Organization Example 

In a somewhat more general example, suppose an organization (e.g., 
a corporation or government department) with thousands of 
employees and numerous offices disposed throughout a large 
geographic area wishes to exercise control over distribution of 
information which belongs to said organization (or association). 



'193 patent at 277:26-32; '900 patent 302:17-24. 



24(G) 



User Environment 

In an organization (or association) such as that described above, 
users may utilize a variety of electronic appliances 600 for 
processing and managing documents. This may include personal 
computers, both networked and otherwise, powerful single-user 
workstations, and servers or mainframe computers. To provide 
support for the control information described in this example, each 
electronic appliance that participates in use and management of 
VDE-orotected documents may be enhancedwithj a » 
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Even if different types of 
PPE 650 are used within an organization to serve different 
requirements, they may be compatible and may operate on the same 
types (or subsets of types) of documents. 

193 patent at 278:45-65; '900 patent 303:40-61 . 



24(H) 



HPEs 655 mayjas shown in Figure 10) be provided with a L 
^pHp^WMglflniilll 674 that makes them more secure. 
Such a software-based tamper resistant barrier 674 may be created 
by software executing on general-purpose CPU 654. Such a 
"secure" HPE 655 can be used by ROS 602 to execute processes 
that, while still needing security, may not require the degree of 
security provided by SPU 500. This can be especially beneficial in 
architectures providing both an SPE 503 and an HPE 655. The SPU 
502 may be used to perform all truly secure processing, whereas one 
or more HPEs 655 may be used to provide additional secure (albeit 
possibly less secure than the SPE) processing using host processor 
or other general purpose resources that may be available within an 
electronic appliance 600. Any service may be provided by such a 
secure HPE 655. In the preferred embodiment, certain aspects of 
"channel processing" appears to be a candidate that could be readily 
exported from SPE 503 to HPE 655. 

The software-based tamper resistant barrier 674 provided by HPE 
655 may be provided, for example, by: introducing time checks 
and/or code modifications to complicate the process of stepping 
through code comprising a portion of kernel 688a and/or a portion 
of component assemblies 690 using a debugger; using a map of 
defects on a storage device (e.g., a hard disk, memory card, etc ) to 
form internal test values to impede moving and/or copying HPE 655 
to other electronic appliances 600; using kernel code that contains 
false branches and other complications in flow of control to disguise 
internal processes to some degree from disassembly or other efforts 
to discover details of processes; using "self-generating" code (based 
on the output of a co-sine transform, for example) such that detailed 
and/or complete instruction sequences are not stored explicitly on 
storage devices and/or in active memory but rather are generated as 
needed; using code that "shuffles" memory locations used for data 
values based on operational parameters to complicate efforts to 
manipulate such values; using any software and/or hardware 
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memory management resources of electronic appliance 600 to 
^^^^^^^^^^^^^F^^^^^ fr° m other processes, functions, 








'193 patent 80:22-65. 




24(1) 




VDE supplies an efficient, lar|d^nsga^ low^^^^_, 
sufficiently secure system ^^^B^SI^Mi^^^^™ 




'193 patent at 9:11-13; '900 patent 9:8-10. 




24(J) 




10. A method as in claim 1 in which said steps of receiving, 
providing, performing and producing occur within a Virtual 
Distribution Environment. 




1 1 A system as in claim 2 in which said first location and said 
second location are contained within a Virtual Distribution 
Environment. 




12. A system as in claim 3 in which said first location and said 
second location are contained within a Virtual Distribution 
Environment. 




13. A system as in claim 6 in which said protected processing 

. • . •„ j within n virtual Distribution Environment. 

environment is contained witnin a v inu<u uiauiuuuvu ^ iit " w 




14 A method as in claim 9 in which said first location and said 
second location are contained within a Virtual Distribution 
Environment. 






TTCTJ < QAQ at 390*1 









97 



t 



Claim Term / 
Phrase 



nterTrust Evidence 



24(K) 




193 patent at 49:59-62. 



24(L) 




193 patent at 221:2-6. 



24(M) 



VDE 100 provided by the preferred embod ™^^Sj 



^ _ , m ,„ and so that the time and cost to 

S^edir^chl"bnite force attack" substantially exceeds any 
value to be derived. In addition, the security provided by^VDE 100 
compartmentalizes mejnt^^wo^n^s^o^^^^^ 



193 patent at 199:38-46. 



24(N) 



VDE supports WBBBB&B8BBS8BBD electronic informaUon 
distribution and usage control models for both commercial 
electronic content distribution and data security applications. 

l 193 patent at 16:25-28. 



24(0) 
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Tingle transaction management control arrangement on each of their 
computers, networks, communication nodes, and/or other electronic 
appliances. Such a general purpose system can serve the needs of 
many electronic transaction management applications without 
requiring distinct, different installations for different purposes. As a 
result, users of VDE can avoid the confusion and expense and other 
inefficiencies of different, limited purpose transaction control 
applications for each different content and/or business model. 

193 patent at 1 1 :38-49; '900 patent at 1 1 :36-47. 



24(P) 



)E features] support ^^^^^s^^^^a — - , 

^ms^^m^^W^i&^^^^s^mSM. This includes 

SingTcollection of techniques that minimizes the damage resulting 

from comprising some aspect of the security features of the present 

inventions. 

'193 patent at 35:59-63 



24(Q) 



Fingerprinting electronic content before it is encrypted for transfer 
to a customer or other user provides information that can be very 
useful for identifying who received certain content which mayjbave 
then been distributed or made availabkm unencrypted form, HH 



'193 patent at 38:4-12 



24(R) 



If a content key becomes compromise^ 




'193 patent at 222:49-53. 
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'193 patent at 223:4-10. 



rotations from Sources Des i pnated hv Mfrrnsnft under PLR 4-2(b) 
24(T) 




Furthermore 



Neumann, Computer Related Risks (ACM Press, 1995), p. 2. 



24(U) 



from (1) physical damage or destruction, (2) human errors and 
omissions, and (3) theft or unauthorized disclosure. That purpose is 
best fulfilled by effective loss-prevention efforts. Loss-prevention 
efforts involve the identification and assessment of risks to capital, 
human, informational, and technological assets, and the 
development of suitable and cost-feasible countermeasures. 

Hurt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 75. 



24(V) 




r^gW^MMffiMasA highly skilled programmer can almost 
always penetrate software safeguards written by another 
programmer. Of course, the same can be said for attorneys; an 
unprincipled lawyer can usually get around protections in a 
contract written by an-other lawyer. Yet contracts continue to be 
written, and, for the most part, they are effective. Computer 
software security rout ines can also be effective most of the time. 
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it is certainly 

SSwhile. The basic consideration is one of degree— how 
important are specific elements of data and software, and how 
important is their security. Some data require very little security. 
For example, a software library containing programs that are 
similar to those found in many other computer installations does 
not require elaborate security protection against theft. On the other 
hand, proprietary programs and sensitive data require extensive 
security. A data base containing payroll information requires 
stringent security procedures to maintain its confidentiality. 

Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 201. 



24(W) 



Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), p. 218. 



24(X) 

ie most 

^e^v^y^^applysecurity protection techniques in layers. 
Each layer of protection diminishes the chances of someone 
breaking through the barriers. 

Hutt et al., Computer Security Handbook, 2d ed. (Macmillan, 1988), pp. 
293. 



24(Y) 

Risk analysis is not intended t ^^^^^^^^^^^ G 

^^^^R^ther' risk analysis produces a degree of 
security commensurate with the information to be protected and 
with the amount of resources to be expended. 

Hoffman, Modern Methods for Computer Security and Privacy (Prentice- 
Hall, 1977), p. 170. 
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24(Z) 




wmsmmmmmmsmmsssBm Computers 
are especially vulnerable because software is complex and we don't 
always know if there are flaws present that make the task of 
breaking in easier. Even systems that are certified according to the 
Department of Defense's so-called Orange Book are vulnerable, 
especially if they are not administered correctly. Just as six-foot- 
thick vaults doors don't work if they're not administered properly. 

Garfinkel et al., Practical Unix Security (O'Reilly & Associates, 1991), pp. 
13. 



24(AA) 



and gains in security 



often come only with penalties in performance. 

Landwehr, Formal Models for Computer Security, ACM Computer Surveys 
(Sept. 3, 1981), p. 253. 



File Histories 
24(BB) 



1. Restriction to 
35U.S.C.§121: 



I is required under 



Group I . . . drawn to a secure component-based operating process, 
classified in Classs 380, subclass 25. 

Group II. . . . drawn to method(s) for managing a resource or 
operating, classified in Class 380, subclass 4. 

Group in. . . . drawn to a secure method, classified in Class 380, 
subclass 3. 

Group IV. . . . drawn to [a] method of negotiating electronic 
contracts, classified in Class 364, subclass 401. 

Group V. . . . drawn to methods of auditing a resource, classified in 
Class 364. subclass 406. 



102 



Intel-Trust Evidence 




2. Inventions of Groups I-V are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from eachodierjfjh^are^ym to be 
separately usable. In the instant < 





as shown by their 
SffeTertTiass^c^tion^ restriction for examination purposes as 
indicated is proper. 



4. Because 




I, restriction for examination 



purposes as indicated is proper. 



'193 File History, 9/25/96 Office Action, pp. 2-3 (a complete copy of this 
document is attached to the Declaration of Douglas K. Derwin In Support 
of InterTrust's Claim Construction Position). 
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Patent Specifications 



25(A) 



Traveling objects can also be used to facilitate "moving" an object 
from one electronic appliance 600 to another. A user could move a 
traveling object, with its incorporated one or more permission 
records 808 from a desktop computer, for example, to his notebook 
computer. A traveling object might register i ^^w^n^^|d 
thereafter only be usea^^^^emer * " * ™* 




193 patent at 133:39-50. 



25(B) 




' The data structures for each meter and 
b^^t^^rmined by the content provider or a 
distributor/redistributor authorized to diangeto^u^^gn^ 




The content provider or distributor/redistributor may specify data 
structures for each meter and budget UDE. Although these data 
structures vary depending upon the particular application, some are 
more common than others. 





Field type Format 



Typical 

Use Description or Use 




byte, 
short, 
long, or 
unsigned 
versions 
of the 



Meter 
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Bitmap 

Wide 
bitmap 

Last Use 
Date 



same 
widths 

byte, 
short, 
long, or 
unsigned 
versions 
of the 
same 
widths 

2, 4 or 8 
byte 
integer 
split into 
two 
related 
bytes or 
words 

Array 
bytes 

Array of 
bytes 

timej 

time t 



Expiration timej 
Date 

Last Audit timej 
Date 

Next Audit timej 
Date 

Auditor VDEID 





Meter 
/Budget 

Meter 
/Budget 

Meter 
/Budget 



Meter 
/Budget 

Meter 
/Budget 

Meter 
/Budget 

Meter 
/Budget 



Bit indicator of use or 
ownership. 

Indicator of use or 
ownership that may age 
with time. 

Date of last use. 




Expiration Date. 

Date of last audit. 

Date of next required 
audit. 

VDE ID of authorized 
auditor. 



The information in the table above is not complete or 
comprehensive, but rather is intended to show some examples of 
types of information that may be stored in meter and budget related 
data structures. The actual structure of particular meters and 
budgets is determined bv one or m ore DTDs 1 108 associated with 
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the load modules 1 100 that create and manipulate the data structure. 
A list of data types permitted by the DTD interpreter 590 in VDE 
1 00 is extensible by properly authorized parties. 

193 patent at 143:38-144:31. 



25(C) 



During the same or different communic^oMe^h^e^^same or 
different clearinghouse may handle BB»BPW ^ B B Bi 
^^^^^^M a*"*/ 01 " permission pertaining to VDE object 300. 



For example, the end user's electronic appliance 600 may (e.g., in 
response to a user input request to access a particular VDE object 
300) send an administrative object to the clearinghouse reque* m f' 
s and/or other permissions allowing access (Block 1 1 ^ 



^^^^^^^^^^^m- Th e clearinghouse may upon receipt ot 
such a request, check the end user's credit, financial records, 
business agreements and/or audit histories to determine whether the 
requested budgets and/or permissions should be given. The 
clearinghouse may, based on this analysis, send one or more 
responsive administrative objects which cause the end user's 
electronic appliance 600 to update its secure database in response 
(Block 1 166, 1 168). This updating might, for example, comprise 
replacing an expired PERC 808 with a fresh one, modifying a PERC 
to provide additional (or lesser) rights, etc. Steps 1 164-1 1 68 may be 
repeated multiple times in the same or different communications 
session to provide further updates to the end user's secure database 
610. 

'193 patent at 162:39-65. 



25(D) 



In the example shown in Figure41d^^^butor at a VDE 
distributor node (106) might ■■H a content creat< * 
at another node (1 02). This request may be made in the context ot a 
secure VDE communication or it may be passed in an "ouj^of- 
channel" commuiujcati^ 



106 



Intel-Trust Evidence 




The distributor's VDE node 106 

niay' respond to the receipt of the budget information by processing 
the rnmmiinicatinnu^ 

method 1510^^^^^^^^^^^Z_III^^" 
ex^lMiiSliMi^ ^ PERC 808 me distributor's 
VDE 106 node to permit the distributor to access content or 
processes for which access is control at least in part by the budget 
and/or PERC. At some point, the distributor 106 may also desire to 
use the content to which she has been granted rights to access. 

After registering to use the content object, the user 1 12 would be 
required to utilize an array of "use" processes 1476C to, for 
example, open, read, write, and/or close the content object as part of 
the use process. 




— — Request process 1480B might initiate a communication 
(!JSaB) with the content creator VDE node 102 requesting more 
budget and perhaps providing details of the use activity to date (e.g., ( 
audit trails). The content creator 102 processes the 'get more budget' 
request event 1482AB using the response process (1484A) within 
the creator's BUDGET method 1510A. Response process 1484A 
might, for example, make a determination if the use information 
indicates proper use of the content, and/or if the distributor is credit 
worthy for more budget. The BUDGET method response process 
1484A might also initiate a financial transaction to transfer funds 
from the distributor to pay for said use, or use the distribute process 
1472 A to distribute budget to the distributor 106. A response to the 
distributor 106 granting more budget (or denying more budget) 
might be sent immediately as a response to the request 
communication 1482AB, or it might be sent at a later time as part of 
a separate communication. The response communication, upon 
being received at the distributor's VDE node 106, might be 
processed using the reply process 1475B within the distributor's 
copy of the BUDGET method 1510B. The reply process 1475B 
might then process the additional budget in the same manner as 
described above. 

The chain of handling; and control may, in addition to posting 
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budget information, also pass control information that governs the 
manner in which said budget may be utilized. For example, the 
control information specified in the above example may also contain 
control information describing the process and limits that apply to 
the distributor's redistribution of the right to use the creator's content 
object. Thus, when the distributor responds to a budget request 
from a user (a communication between a user at VDE node 1 1 2 to 
the distributor at VDE node 106 similar in nature to the one 
described above between VDE nodes 106 and 102) using the 
distribute process 1472B within the distributor's copy of the 
BUDGET method 1510B, a distribution and request/response/reply 
process similar to the one described above might be initiated. 

'193 patent at 172:61-174:29. 



25(E) 



Transportability of VDE Installations Between PPEs 650 




m 




VDE object 300 can be 



redistributed, then electronic appliance 600 normally must have a 
"budget" and/or other permissioning that allows il ^redistribute the 




A PPE 650 that receives one of the administrative objects may have 
the ability to use at least a portion of the budgets, or rights, to 
related objects. 

'193 patent at 220:20-40. 
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25(F) 



In addition, for examplejui 



mfenj 



mm 



'193 patent at 48:29-35. 



25(G) 



. w ,-.«.»• .aaaass,^ such differing sets of control 
^^^S^ytS^T^T control purposes, the same, or 
differing, granularities of electronic information control increments. 
This includes supporting variable control information for budgeting 
and auditing usage as applied to a varijty of ^redefinedhnCTen^ 
of electronic information, including 

^ ^ for: billing units of measure, credit limit, 

ScStytSgeTumit and security content metering increments, 
and/or market surveying and customer profiling content metering 
increments. 

l 193 patent at 28:19-37. 



25(H) 



support the flowing of content control information through 
different "branches" of content control information handling so as to 
accommodate, under the present invention's preferred embodiment, 
diverse controlled distributions of ^^^^^^^^ 

instance^ party who first placed control information on content can 
make certain control assumptions and these assumptions would 
evolve into more specific and/or extensive control assumptions. 
These control assumptions can evolve during the branching 
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sequence upon content model participants submitting control ^ 
information changes, for example, for use in "negotiating" with in 
place" content control information. This can result in new or 
modified content control information and/or it might involve the 
selection of certain one or more already "in-place" content usage 
control methods over in-place alternative methods, as well asthe 
submission of relevant control inf orm ^^^^^^^feS 
form of evolution of si 



land/or 



fiance results from VDE control information flowing "down 
through different branches in an overall pathway of handling and 
control and being modified differently as it diverges down these 
different pathway branches. 

'193 patent at 31:29-56. 



25(1) 



nreme^immmSiWwsSm^^m- "This allows, for example, for 
concurrent business activities which are dependent on electronic 
commercial product content distribution, such as acquiring detailed 
market survey information and/or supporting advertising, both of 
which can increase revenue and result ' ll ^^^^^^^^^ GTS 
and greater value to content providers. " ot * 



_____ jjin a pathway of content, rep^mg^^^^^^^or 
related control information handling * ' 



sxamr 



- . Alternatively, for example, a one distributor 
^Ee right to distribute a different array of properties than 
another distributor (from a conmionc^nt^^c^i^^ for 
example, on optical disc). J 

iavi 




110 



t 



Claim Term / 
Phrase 



InterTrust Evidence 



eontCTifusgf 
'193 patent at 30:42-31:7. 



25(J) 



^ ,„ , - -ggaarewrr For example, content 
^^^K^S"of content may be stipulated as 
senior information and therefore not changeable, might be put m 
place by a content creator and might stipulate that national 
distributors of a given piece of their content may be permitted to 
make 100,000 copies per calendar quarter, so long as such copies 
are provided to bona fide end-users, but may pass only a single copy 
of such content to a local retailers and the control information i limits 
such a retailer to making no more than 1,000 copies per month for 
retail sales to end-users. In addition, for example, an end-user of 
such content might be limited by the same content control 
information to making three copies of such content, one for each of 
three different computers he or she uses (one desktop computer at 
work, one for a desktop computer at home, and one for a portable 
computer). 

'193 patent at 48:15-35. 



25(K) 



In this example, as illustrated I in ^ Fig^80j 

^g^^^jll^p^^P I I IP " In either case, user B may 
be able to establish m*eFown control information on DA(CA)^ 

and/or ^>^ DA ^^^l^^^^^ 
control information. w -^--"^ v -' — *'** AA 



.,„ WMK^ M^ ' As d^ribed in connection with an earlier 
Sample, user B may have received control information from 
user/distributor B along a chain of handling including 
user/distributor A that bases fees on the number of minutes that user 
r makfts use of creator A's content (and requiring user/distributor A 
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to pay fees of $1 5 per month per user to distributor A regardless of 
the amount of usage by user B in a calendar month). This may be 
more favorable under some circumstances than the fees required by 
a direct use of control information provided by distributor A, but 
may also have the disadvantage of an exhausted chain of 
redistribution and, for example, further usage information reporting 
requirements included in UDB(UDA(DA(CA))). If the two sets of 
control information DA(CA) and UDB(UDA(DA(CA))) permit (e.g. 
do not require exclusivity enforced, for example, by using a 
registration interval in an object registry used by a secure subsystem 
of user B's VDE installation to prevent deregistration and 
reregistration of different sets of control information related to a 
certain container (or registration of plural copies of the same content 
having different control information and/or being supplied by 
different content providers) within a particular interval of time as an 
aspect of an extended agreement ^^^^^^^^^^^^^^^^^ 

'193 patent at 306:30-65. 


25(L) 

For example, user/distributor A may receive control information CB 
that includes a requirement that user/distributor A pay creator B for 
content decrypted by user/distributor A (and any participant 
receiving distributed and/or redistributed control information from 
user/distributor A) at the rate of $0.50 per kilobyte. As indicated 
above, user/distributor A also may receive control information 

4 193 patent at 308:29-42. 


25(M) 

As illustrated in Figure 81, in this example, ^^^^^^M 
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WcB directly from creator B, 



Gontafflei%pp^i>i&^ J 

DA0CB)1i^^ 

UDB(UDA(CB)) from user/distributor B, DC(CB) from distobutor 
C, and/or L^W^g^t 1 , 

^ _ Twoofthese 

fh^^^C^Si^ibutorB. Based on a VDE negotiation 
between user/distributor B and user B, an extended agreement may 
be reached (if permitted by control information governing both 
parties) that reflects the conditions under which user B may use one 
or both sets of control information. In this example, two chains oi 
handling and control may "converge" at user/distributor B, and then 
pass to user B (and if control information permits, later diverge once 
again based on distribution and/or redistribution by user B). 

'193 patent at 308:48-65. 



25(N) 




Seated bTcreator B, creator C, and creator D in addition to one or 
more extracted/embedded^rti^o^o^^c^^^^^E. 



Si character of such extracted/embedded portions (e.g. multimedia 
presentations illustrating potential areas of interest in the remainder 
of the content, commentary explaining and/or exposing other 
elements of content, related works, improved^^U^^^^ 
delivered as an element of content, etcO^^^W^M^^^^^ 
^^^^l^^g^^P^^^^^^^^) of such portions; 

and other considerations which distinguish the containers and/or 
content control information received, in this example, from 
distributor B and distributor C. 

'193 patent at312:ll-31. 
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25(0) 



As with standard VDE objects 300, a ^^^^^^ 
contact a clearinghouse service to acauire W " ' " " " 



'193 patent at 131:10-13. 



25(P) 



jg!M_«__ 

uc . The distributor 106 might then 

SteT^ets using the BUDGET method request process 
(1480B) Request process 1480B might initiate a communication 
(1482AB) with the content creator VDE node 102 requesting more 
budget and perhaps providing details of the use activity to date (e.g., 
audit trails). The content creator 102 processes the 'get more budget 
request event 1482AB using the response process (1484A) within 
the creator's BUDGET method 1510A. Response process 1484A 
might, for example, make a determination if the use information 
indicates proper use of the content, and/or if the distributor is credit 
worthy for more budget. The BUDGET method response process 
1484A might also initiate a financial transaction to transfer funds 
from the distributor to pay for said use, or use the d^rftute^^g 
1472A to distribute budget to the ^stributorl06. JflfcoP"»«M 



wmmmmemmm&imB^ 2 ® a response to the request 
c^rZSXtion 1482AB, or it might be sent at a later time as part of 
a separate communication. The response communication, upon 
being received at the distributor's VDE node 106, might be 
processed using the reply process 1475B within the distributor s 
copy of the BUDGET method 1510B. The reply process 1475B 
might then process the additional budget in the same manner as 
described above. 

'193 patent at 173:21-174:14. 



25(Q) 



During the same or different conimunica^|ns^^e^^same or 

different «PBHjPSliP^™ t 
fiMBBMB^ and/or permission pertaining to VDE obiect 300. 
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For example, the end user's electronic appliance 600 may (e.g., in 
response to a user input request to access a particular VDE object 
300) send an administrative object to the clearinghouse requesting 
budgets and/or other permissions allowing access (Block 1 164). As 
mentioned above, such requests may be transmitted m the form ot 
one or more administrative objects, such as, for example a single 
administrative object having multiple "events" associated with 
multiple requested budgets and/or other permissions for the same or 
different VDE objects 300. The clearinghouse may upon receipt ot 
such a request, check the end user's credit, financial records, 
business agreements and/or audit histories to determine ^whether the 
requested budgets and^orp^^sians^ouMbe^v^ »§ 



■ ' cj- • ^tass^^^^^"^ 16 ^ 1 164-1 168 be 

^^^^SeThTme sanTe or different communications 
session to provide further updates to the end user's secure database 
610. 

'193 patent at 162:39-65. 
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"controlling the 
copies made of 
said digital file" 



InterTrust Evidence 
Patent Specifications 
26(A) 




pi yv^v^ ! ^;; ;vr.riiT^--'— ^ SUC ^ ^i^fe™^ SetS of Control 

infamSonnSr employ, for control purposes, the same, or 
differing, granularities of electronic information control increments. 
This includes supporting variable control information for budgeting 
and auditing usage as applied to a 
of electronic infonnatioii, including 



mji ^„ s-sa^sJ f° r: billing units of measure, credit limit, 
^^^Sd^Turut and security content metering increments, 
and/or market surveying and customer profiling content metering 
increments. 

'193 patent at 28:19-37. 



26(B) 



support the flowing of content control information through 
different "branches" of content control information handling so as to 
accommodate, under the present invention's preferred embodiment, 
diverse controlled distributions of VD^^^^^^nt M 

eri 



In this 



instance, a party who first placed control information on content can 
make certain control assumptions and these assumptions would 
evolve into more specific and/or extensive control assumptions. 
These control assumptions can evolve during the branching 
sequence upon content model participants submitting control 
information changes, for example, for use in "negotiating" with ' m 
place" content control information. This can result in new or 
modified content control information and/or it might involve the 
selection of certain one or more already "in-place" content usage 
control methods over in-place alternative methods, as well as the 
submission of relevant control information parameter data. This 

form of evolution of^^^^S^^^^E^™,^™ . . 
l^^^imMM^^&^^oMI and/or 
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appliance results from VDE control information flowing "down" 
through different branches in an overall pathway of handling and 
control and being modified differently as it diverges down these 
different pathway branches. 

'193 patent at 31:29-56. 



26(C) 



Bigffla^BfflsPMiM- This allows, for example, for 
concurrentbusiness activities which are dependent on electronic 
commercial product content distribution, such as acquiring detailed 
market survey information and/or supporting advertising, both of 
which can increase revenue and result inbw^conje^co^^sers 
and greater value to content providers 





g i i t j in a pathway of content, reporting 
related control informationharkUinj 



layment, and/or 




Alternatively, for example, a one distributor 

may havethe right to distribute a different array of properties than 
another distributor (from a conunor^con^t^^ctionp^v^, for 




'193 patent at 30:42-31:7. 



26(D) 
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^^^^^^^^^^^^^^^^^ 

W^^^mWMMl^^m' For example, content 

control information for a given piece of content may be stipulated as 
senior information and therefore not changeable, might be put in 
place by a content creator and might stipulate that national 
distributors of a given piece of their content may be permitted to 
make 100,000 copies per calendar quarter, so long as such copies 
are provided to bona fide end-users, but may pass only a smgle copy 
of such content to a local retailers and the control information limits 
such a retailer to making no more than 1,000 copies per month for 
retail sales to end-users. In addition, for example, an end-user of 
such content might be limited by the same content control 
information to making three copies of such content, one for each ot 
three different computers he or she uses (one desktop computer at 
work, one for a desktop computer at home, and one for a portable 
computer). 

'193 patent at 48:15-35. 


26(E) 

:, ^^^^^^^^^^eived cc-ntrolir^ from 
user/distributor B along a chain of handling including 
user/distributor A that bases fees on the number of minutes that user 
B makes use of creator A's content (and requiring user/distributor A 
to pay fees of $15 per month per user to distributor A regardless of 
the amount of usage by user B in a calendar month). This may be 
more favorable under some circumstances than the fees required by 
a direct use of control information provided by distributor A, but 
may also have the disadvantage of an exhausted chain of 
redistribution and, for example, further usage information reporting 

^ * Tmu/iTnAfnAfCAYfi If the two sets of 
requirements included in UDUtuuAtu/H^/v;;. ^ ^ lvvu v 

control information DA(CA) and UDB(UDA(DA(CA))) permit (e.g. 

do not require exclusivity enforced, for example, by using a 

registration interval in an object registry used by a secure subsystem 

of user B's VDE installation to prevent deregistration and 
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reregistration of different sets of control information related to a 
certain container (or registration of plural copies of the same content 
having different control information and/or being supplied by 
different content providers) within a particular interval of time as an 
aspect of an extended agreementfor 

'193 patent at 306:30-65. 


26(F) 

For example, user/distributor A may receive control information CB 
that includes a requirement that user/distributor A pay creator B for 
content decrypted by user/distributor A (and any participant 
receiving distributed and/or redistributed control information from 
user/distributor A) at the rate of $0.50 per kilobyte. As indicated 
above, user/distributor A also may receive control information 
associated with creator B's^^^r^n^o^^^^^^^^ 

'193 patent at 308:29-42. 


26(G) 

. As illustrated in Fi ^^^^^^^^^^^^^^^^^ 

DA(CB) from distiiEitor A* UDB(UD A(DA(CB))) and/or 
UDB(UDA(CB)) from user/distributor B, DC^^J^m^^butor 

C, and/or ^^^^^^^^S^S^^^^^^^^g 

c^u^^hrougTuser/disfributor B. Based on a VDE negotiation 
between user/distributor B and user B, an extended agreement may 
be reached (if permitted by control information governing both 
parties) that reflects the conditions under which user B may use one 
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or both sets of control information. In this example, two chains of 
handling and control may "converge" at user/distributor B, and then 
pass to user B (and if control information permits, later diverge once 
again based on distribution and/or redistribution by user B). 

'193 patent at 308:48-65. 



26(H) 




created by creator B, creator C, and creator D in addition to one or 
more extracted/embedded^^o^of^n^^^^d^c^agE. 



the character of such extracted/embedded portions (e.g. multimedia 
presentations illustrating potential areas of interest in the remainder 
of the content, commentary explaining and/or expositing other 
elements of content, related works, impro^application software 

delivered as an element of content, et^S^^^--.---------- — 

^^H^^^S^^^^^^H) °f sucn portions; 
and other considerations which distinguish the containers and/or 
content control information received, in this example, from 
distributor B and distributor C. 

'193 patent at 312:1 1-31. 
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27. 721.1: "digitally 
signing a second 
load module with 
a second digital 
signature 
different from the 
first digital 
signature, the 
second digital 
signature 
designating the 
second load 
module for use by 
a second device 
class having at 
least one of 
tamper resistance 
and security level 
different from the 
at least one of 
tamper resistance 
and security level 
of the first device 
class" 



Intel-Trust Evidence 



Patent Specifications 



27(A) 

In accordance with one aspect provided by the present invention, 
one or more trusted verifying authorities validate loa ^^^^ or 

^^^^^^^^^^^^^^^^^^key based digital 
signature and/or certificate based thereon, for example). 

Protected execution spaces such as protected processing 
environments can be programmed or otherwise conditioned to 
accept only those load modules or other executables bearing a 

digital signature/certificate of an accredited (or particular) verifying 

authority. 

'721 patent at 4:61-5:5. 



27(B) 




<^u^kmz^*z&, r-n-TiT , -, can be 

helps protect the remainder of the system should parts of the system 
become compromised. 

For example, protected processing environments or other secure 
execution spaces that are more impervious to tampering (such as 
those providing a higher degree of physical security) may use an 
assurance level that isolates it from protected processmg 
environments or other secure execution spaces that are relatively 
more susceptible to tampering (such as those constructed solely by 
software executing on a general purpose digital computer in a non- 
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secure location). 




A protected processing 
environment or other secure execution space protects itself by 
executing only those load modules or other executables that have 
been digitally signed for its corresponding assurance level. 

The present invention may use a verifying authority and the digital 
signatures it provides to compartmentalize the different electronic 
appliances depending on their level of security (e.g., work factor or 
relative tamper resistance). In particular, a verifying authority and 
the digital signatures it provides isolate appliances with significantly 
different work factors — preventing the security of high work factor 
appliances from collapsing into the security of low work factor 
appliances due to free exchange of load modules or other 
executables. 

'721 patent at 6:16-62. 



27(C) 
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Assurance level I might be used for an electronic apphance(s) 61 
whose protected processing environment 108 is based on software 
techniques that may be somewhat resistant to tampering. An^ 
example of an assurance level I electronic appliance 61A might be a 
general purpose personal computer that executes software to create 
protected processing environment 108. 

An assurance level II electronic appliance 61B may provide a 
protected processing environment 1 08 based on a hybrid of software 
security techniques and hardware-based security techniques. An 
example of an assurance level II electronic appliance 61B might be 
a general purpose personal computer equipped with a hardware 
integrated circuit secure processing unit ("SPU") that performs 
some secure processing outside of the SPU (see Ginter et al. patent 
disclosure Figure 10 and associated text). Such a hybrid 
arrangement might be relatively more resistant to tampering than a 
software-only implementation. 

The assurance level III appliance 61C shown is a general purpose 
personal computer equipped with a hardware-based secure 
processing unit 132 providing and completely containing protected 
processing environment 108 (see Ginter et al. Figures 6 and 9 for 
example). A silicon-based special purpose integrated circuit 
security chip is relatively more tamper-resistant than 
implementations relying on software techniques for some or all ot 
their tamper-resistance. 

In this example, verifying authority 100 digitally signs load modules 
54 using different digital signature techniques (for example, 
different "private" keys 122) based on assurance level. The digital 
signatures 106 applied by verifying authority 100 thus securely 
encode the same (or different) load module 54 for use by 
appropriate corresponding assurance level electronic appliances 61. 

A^irance level in this example mav be assigned to a particular 
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protected processing environment 108 at initialization (e.g., at the 
factory in the case of hardware-based secure processing units). 
Assigning assurance level at initialization time facilitates the use of 
key management (e.g., secure key exchange protocols) to enforce 
isolation based on assurance level. For example, since 
establishment of assurance level is done at initialization time, rather 
than in the field in this example, the key exchange mechanism can 
be used to provide new keys (assuming an assurance level has been 
established correctly). 

'721 patent at 16:37-17:23. 


27(E) 

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 

54 between different electronic appliances is regarded as an open 
communications channel between the protected processing 
environments 108 of the two appliances, it becomes apparent that 
there is a high degree of risk in permitting such sharing to occur. In 
particular, the extra security assurances and precautions of the more 
trusted environment are collapsed into the those of the less trusted 
environment because an attacker who compromises a load module 
within a less trusted environment is then be able to launch the same 
load module to attack the more trusted environment Hence, 
although compartmentalization based on encryption and key 
management can be used to restrict certain kinds of load modules 54 
to execute only on certain types of electronic appliances 61 , a 
significant application in this context is to compartmentalize the 
different types of electronic appliances and thereby allow an 
electronic appliance to protect itself against load modules 54 of 
different assurance levels. 

'721 patent at 18:19-38. 


27(F) 

In accordance with this feature of the invention, verifying authority 
100 supports all of these various categories of digital signatures, and 
system 50 uses key management to distribute the ^PP^^^^^^. 
verific^^^e^s to different asSura ^5^^^^^^^^^^^^^J 
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To simplify key management and distribution, execution 
environments having significantly similar work factors can be 
classified in the same assurance level. Figure 13 shows one 
example hierarchical assurance level arrangement. In this example, 
less secure "software only" protected processing environment 108 
devices are categorized as assurance level I, somewhat more secure 
"software and hardware hybrid" protected processing environment 
appliances are categorized as assurance level II, and more trusted 
"hardware only" protected processing environment devices are 
categorized as assurance level III. 






'721 patent at 19:11-32. 

„ „ , > 






27(G) 






A load module or ^^^^^^^^^^^^^^^^^^^^^^p 






'721 patent at 20:1-4. 
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28. 


891.1: "securely 
applying, at said 
first appliance 
through use of 
said at least one 
resource said first 
entity's control 
and said second 
entity's control to 
govern use of 
said data item" 


Patent Specifications 
28(A) 

The embedding processes for all VDE embedded content containers 
normally involves securely identifying the appropriate content 
control information for the embedded content. For example, VDE 
content control information for a VDE installation and/or a VDE 
content container may securely, and transparently to an embedder 
(user), apply the same content control information to edited (such as 
modified or additional) container content as is applied to one or 
more portions (including all, for ex ^Pfg)f^PJ^^^^y J'^P^j" 
content of said container and/or ^^t^^^p^^^^^^^ 
generated through a VDE control information negotiation between 
control sets, and/or it may apply control information previously 
applied to said content. Application of control information may 
occur regardless of whether the edited c^^CT^^^^^rent or 

m&^MmnW^^^^^^&M i^^^ may be automatically and/or 
transparently applied), may also be employed with content that is 
embedded into a VDE container through extracting and embedding 
content, or through the moving, or copying and embedding, of VDE 
container objects. Application of content control information 
normally occurs securely within one or more VDE secure 
sub-system PPEs 650. This process may employ a VDE template 
that enables a user, through easy to use GUI user interface tools, to 
specify VDE content control information for certain or all embedded 
content, and which may include menu driven, user selectable and/or 
definable options, such as picking amongst alternative control 
methods (e.g. between different forms of metering) which may be 
represented by different icons picturing (symbolizing) different 
control functions and apply such functions to an increment of VDE 
secured content, such as an embedded object listed on an object 
directory display. 

'193 patent at 299:19-51. 


28(B) 

Embedded content (and/or content objects) may have been 
contributed by different parties and may be integrated into a VDE 
container through a VDE content and content control information 
integration process securely managed through the use of one or 
more secure VDE subsystems. This process may, for example, 
involve one or more of: 
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(iJl^S^ 

^^^^^^SSiWKwneiein said instructions were 
securely put in place, at least in part, by a content provider and/or 
user of said VDE container. For example, said user and/or provider 
may interact with one or more user interfaces offering a selection of 
content embedding and/or control options (e.g. in the form of a VDE 
template). Such options may include which, and/or whether, one or 
more controls should be applied to one or more portions of said 
content and/or the entry of content control parameter data (such a 
time period before which said content may not be used, cost of use 
of content, and/or pricing discount control parameters such as 
software program suite sale discounting). Once required and/or 
optional content control information is established by a provider 
and/or user, it may function as content control information which 
may be, in part or in full, applied automatically to certain, or all, 
content which is embedded in a VDE content container. 



'193 patent at 300:6-30. 



28(C) 



Users of VDE may include content] 



^^^^^^^S^^^I^KJ' and/or appliances for users such as 
end-user organizations, individuals, and content and/or appliance 
distributors. 

' 193 patent at 9:40-45. 



28(D) 

For example, in a VDE aware word processor application, a user 
may be able to "print" a document into a VDE content container 
obj 

(for example, a confidential memo template for internal organization 
purposes may restrict the ability to "keep," that is to make an 
electronic copy of the memo). 

'193 patent at 26:59-67. 
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28(E) 



samel 



ae™jfand/or to different parties in a content and/or appliance 
usage model, such that different parties (or classes of VDE users, for 
example) are subject to differing control information managing their 
use of electronic information content. For example, differing 
control models based on the category of a user as a distributor of a 
VDE controlled content object or an end-user of such content may 
result in different budgets being applied. 



'193 patent at 30:55-65. 



28(F) 



Keys and tags may be HEi generated within j 
655) in the preferred embodiment. 



1503 



'193 patent at 120:15-16. 



28(G) 



Frequently, for a VDE application for a given content model (such 
as distribution of entertainment on CD-ROM, content delivery from 
an Internet repository, or electronic catalog shopping and 
advertising, or some combination of the above) participants would 
be able to securely select from amongstavailable, alternative contra 

methods andlHnnifl such sel + f ! on of 

control method and/or submission of data would constitute their 

"contribution" of control information. 
'193 patent at 18:60-19:1. 



28(H) 



ROS 602 assembles these elements together into an executable 
component assembly 690 prior ^ad^^^u^tiw^^ 
component assembly (e.g., in a s§fmm^£~ — 



'193 patent at 83:44-48 
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29. 


900.155: "derives 
information from 
one or more 
aspects of said 
host processing 
environment" 


Patent Specifications 
29(A) 

Correspondence Between Installed Software and Appliance 
"Signature". Another technique that may be used during the 
installation routine 3470 is to customize the operational materials 
3472 by embedding a "machine signature" into the operational 
materials to establish a correspondence between the installed 
software on a particular electronic appliance 600 (Figure 69C, block 
3470(7)). This technique prevents a software-based PPE 650 from 
being transferred from one electronic appliance 600 to another 
(except through the use of the appropriate secure, verified backup 
mechanism). 

For electoo^c^^^^ps 600 ^^^^^^^^^^^^^^^^^ 

l^^^^^^^^^^^^^^ation routine 3470 embeds the 
electronic appliance "signature" SIG in the installed operational 
materials 3472. Upon initialization, the operational materials 3472 
validate the embedded signature value against the actual electronic 
appliance 600 signature SIG, and may refuse to start if the 
comparison fails. 

Dej^nding on the confi^^^^^^ele^^ra^ca^^^^^^^^^ 
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Ficnire fiQfi shows an examnle of some of these aDoliance-soecific 
signatures. 

'900 patent at 239:4-42. 
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912.8: 

"identifying at 
least one aspect 
of an execution 
space required for 
use and/or 
execution of the 
load module" 



InterTrust Evidence 

Patent Specifications 

The following is an example of a possible field layout for load 
module public header 802: 



Field Type 



Description 



LM ID 



Creator ID 
Type ID 
LM ID 



Version ID 

Other Class ID 

classification 

information 

Type ID 

Descriptive Description 
Information 



VDE ID of Load Module. 

Site ID of creator of this load 
module. 

Constant indicates load 
module type. 

Unique sequence number for 
this load module, which 
uniquely identifies the load 
module in a sequence of load 
modules created by an 
authorized VDE participant 

Version number of this load 
module. 

ID to support different load 
module classes. 

ID to support method type 
compatible searching. 

Textual description of the load 
module. 






'193 patent at 140:15-46. 
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